{"id":"CVE-2026-103522","published":"2026-10-12T15:17:05.690","lastModified":"2026-10-13T13:51:00.250","description":"In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server.","cvssScore":7.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://kb.cert.org/vuls/id/162329","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}