CERT /CC has warned that 11 Thelia vulnerabilities remain unpatched, with seven of them capable of remote code execution by an authenticated back‑office user. The CERT/CC note highlights a patch gap, noting that the vendor could not be reached and no fix is yet available. The round‑up lists 11 CVEs across Thelia 2.x (2.6.0 and 2.6.1) and Thelia 3.0.0, including a template injection flaw in the Messages feature (CVE-2026-107248).
Highest recorded CVSS is 7.2 for CVE-2026-103521, and several other CVEs are awaiting analysis or remain not exploited according to the report. Exploitable issues largely arise from weak checks around admin features, file uploads, and the bundled code executed by the module installer, which together could allow an attacker with admin access to gain full server control.
What this means in practice is that Thelia storefronts could be exposed to significant data risk if an attacker compromises an admin account or leverages browser‑based flaws such as stored or reflected XSS. CERT/CC stresses that, taken together, these vulnerabilities can facilitate a complete server takeover for authenticated administrative attackers, even though no in‑the‑wild exploits or PoCs have been publicly confirmed at the time of the note.
With no patch available, mitigations focus on restricting access to Thelia’s admin interfaces, disabling or tightly limiting file‑upload and template editing, removing PHP execution permissions from user‑writable directories, and employing network controls such as VPN or IP allowlists, rate limiting, and proxy‑level protections until an official vendor update is released.