{"metadata": {"vulnerability": "CVE-2026-103522", "count": 13, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-09-30T19:03:43.339Z", "date_only": false, "value": "2026-09-30T19:03:43.339Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-103522", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T14:53:34.695Z", "date_only": false, "value": "2026-10-12T14:53:34.695Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-103522", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T14:53:34.695Z", "date_only": false, "value": "2026-10-12T14:53:34.695Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / certcc", "record": "CVE-2026-103522", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T14:59:38.844Z", "date_only": false, "value": "2026-10-12T14:59:38.844888Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-103522", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2026-10-12T14:59:38.844Z", "date_only": false, "value": "2026-10-12T14:59:38.844888Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103522", "record": "FKIE_CVE-2026-103522", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-12T14:59:41.947Z", "date_only": false, "value": "2026-10-12T14:59:41.947Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-103522", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-12T14:59:41.947Z", "date_only": false, "value": "2026-10-12T14:59:41.947Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-103522", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T14:59:44.610Z", "date_only": false, "value": "2026-10-12T14:59:44.610870Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117428530976339537", "record": "CVE-2026-103522", "field": "creation_timestamp", "uuid": "7e49c5db-4182-47cf-97a6-8b4cfee49404", "content": "CVE-2026-103522 CVE-2026-103522 In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client\u2011supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server.\nhttps://www.cve.org/CVERecord?id=CVE-2026-103522https://kb.cert.org/vuls/id/162329#Thelia#CVE_2026_103522#bot", "url": "https://infosec.exchange/users/cve/statuses/117428530976339537"}, {"timestamp": "2026-10-12T15:17:05Z", "date_only": false, "value": "2026-10-12T15:17:05Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-FR55-RFPM-H943", "record": "GHSA-FR55-RFPM-H943", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T15:17:05.690Z", "date_only": false, "value": "2026-10-12T15:17:05.690", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103522", "record": "FKIE_CVE-2026-103522", "field": "published"}, {"timestamp": "2026-10-12T15:32:19Z", "date_only": false, "value": "2026-10-12T15:32:19Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-FR55-RFPM-H943", "record": "GHSA-FR55-RFPM-H943", "field": "published"}, {"timestamp": "2026-10-12T15:32:19Z", "date_only": false, "value": "2026-10-12T15:32:19Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-FR55-RFPM-H943", "record": "GHSA-FR55-RFPM-H943", "field": "modified"}, {"timestamp": "2026-10-13T13:51:00.250Z", "date_only": false, "value": "2026-10-13T13:51:00.250", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103522", "record": "FKIE_CVE-2026-103522", "field": "lastModified"}]}