Yüksek CVSS 7.2
CVE-2026-103522: CVE-2026-103522: tehlikeli dosya yükleme
Açıklama (NVD)
In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server.
Özet bilgiler
- CVSS v3.1
- 7.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - EPSS
- %0,58 (yüzdelik 48)
- CWE
- CWE-434
- Yama
- Yok / bilinmiyor