Description
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Thelia Thelia
Default version status: unaffected
0 to < 3.1.2affected3.2.0 to < 3.2.1affected
pkg:composer/thelia/theliaReferences
- https://github.com/thelia/thelia/security/advisories/GHSA-5524-qfxp-33v9 ↗
- https://github.com/thelia/thelia/commit/6b706f5cb96e6b12d890c6d16edb1c9d1fd8191a ↗
- https://github.com/thelia/thelia/commit/b71258902b5dd278007d0f37ddad45f76d06d5bc ↗
- https://github.com/thelia/thelia/blob/3.2.0/core/lib/Thelia/Core/File/Service/FileProcessorService.php#L119-L160 ↗
- https://github.com/thelia/thelia/releases/tag/3.1.2 ↗
- https://github.com/thelia/thelia/releases/tag/3.2.1 ↗
- https://www.vulncheck.com/advisories/thelia-before-3.1.2-and-3.2-x-before-3.2.1-file-upload-rce-via-filename-trailing-space ↗