Thelia
Thelia Security Releases - October 2026
thelia-2026-10 Oct 1, 2026 Source: Vendor
Thelia security advisories for October 2026, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2026-103521
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
3 lines
Showing 1–3 of 3
CVE-2026-109396
BR2026-0000-027113
Thelia
unclaimed
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, chec...
Credited as HunterSploit
CVE-2026-109397
BR2026-0000-027114
Thelia
unclaimed
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filena...
Credited as HunterSploit
CVE-2026-112285
BR2026-0000-040179
Thelia
unclaimed
Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become...
Credited as HunterSploit