Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1

{
  "id": "71f70e26dd9db58c8b6cfd3279a3a292f68deecfef5f7cd40a0dec54f28396fb",
  "url": "https://kb.cert.org/vuls/id/162329",
  "method": "llm",
  "payload": {
    "kind": "advisory",
    "title": "Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1",
    "summary": "Thelia 2.6.0 and 2.6.1 have vulnerabilities that can enable remote code execution, cross-site scripting, open redirects, and other attacks. A patch is not yet available; the advisory recommends restricting access to administrative interfaces and limiting risky features.",
    "evidence": "Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows.",
    "products": [
      {
        "name": {
          "value": "Thelia",
          "evidence": "Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "2.6.0",
            "evidence": "In Thelia v2.6.0"
          },
          {
            "value": "2.6.1",
            "evidence": "Thelia v2.6.1 contains path traversal"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-103521",
        "evidence": "CVE-2026-103521 In Thelia v2.6.0"
      },
      {
        "value": "CVE-2026-103522",
        "evidence": "CVE-2026-103522 In Thelia v2.6.0"
      },
      {
        "value": "CVE-2026-103523",
        "evidence": "CVE-2026-103523 Thelia v2.6.0"
      },
      {
        "value": "CVE-2026-103524",
        "evidence": "CVE-2026-103524 Thelia v2.6.0"
      },
      {
        "value": "CVE-2026-103526",
        "evidence": "CVE-2026-103526 In Thelia v2.6.0"
      },
      {
        "value": "CVE-2026-103527",
        "evidence": "CVE-2026-103527 Thelia v2.6.0's Smarty templates"
      },
      {
        "value": "CVE-2026-103528",
        "evidence": "CVE-2026-103528 Thelia 2.6.0 uses Smarty"
      },
      {
        "value": "CVE-2026-103529",
        "evidence": "CVE-2026-103529 Thelia v2.6.0 permits"
      },
      {
        "value": "CVE-2026-103535",
        "evidence": "CVE-2026-103535 Thelia v2.6.1 contains"
      },
      {
        "value": "CVE-2026-103537",
        "evidence": "CVE-2026-103537 Thelia v2.6.1 contains"
      },
      {
        "value": "CVE-2026-107248",
        "evidence": "CVE IDs: CVE-2026-103521 CVE-2026-103522 CVE-2026-103523 CVE-2026-103524 CVE-2026-103526 CVE-2026-103527 CVE-2026-103528 CVE-2026-103529 CVE-2026-103535 CVE-2026-103537 CVE-2026-107248"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-cert-cc-vulnerability-notes",
  "document_id": 23369,
  "published_at": "2026-10-12T14:52:17.431+00:00"
}