What is GHSA-9w4q-cg82-c2wf?

GHSA-9w4q-cg82-c2wf is a security advisory published by GitHub Security Advisories with unknown severity. Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP...

Which CVE IDs does GHSA-9w4q-cg82-c2wf cover?

GHSA-9w4q-cg82-c2wf covers the following CVE IDs: CVE-2026-103529. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-9w4q-cg82-c2wfunknown

Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP...

Vendor

GitHub Security Advisories

Published

October 12, 2026

Last Modified

October 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-103529 →

📋 Description

Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's install() method which will then be executed upon installation, enabling remote code execution with the privileges of the web server.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-103529
https://kb.cert.org/vuls/id/162329
https://github.com/advisories/GHSA-9w4q-cg82-c2wf