CERT/CC discloses critical RCE vulnerabilities in Thelia 2.6.0 and 2.6.1

CERT/CC has published details on multiple critical vulnerabilities in the Thelia e-commerce platform versions 2.6.0 and 2.6.1 that allow remote code execution via file uploads, Smarty templates, and the translation editor. No vendor patch is available yet, with 11 CVEs affected.

• RCE possible via document, banner, module, and email template uploads
• Vulnerabilities affect Thelia 2.6.0 and 2.6.1, 11 CVEs total
• No vendor patch available; isolating the admin panel is advised
• Attacks require admin or limited admin privileges