{"metadata": {"vulnerability": "CVE-2026-103535", "count": 10, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 5}}, "data": [{"timestamp": "2026-09-30T19:07:09.910Z", "date_only": false, "value": "2026-09-30T19:07:09.910Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-103535", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T14:55:58.210Z", "date_only": false, "value": "2026-10-12T14:55:58.210Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-103535", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T14:55:58.210Z", "date_only": false, "value": "2026-10-12T14:55:58.210Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-103535", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-12T14:55:58.210Z", "date_only": false, "value": "2026-10-12T14:55:58.210Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / certcc", "record": "CVE-2026-103535", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T15:12:08.068Z", "date_only": false, "value": "2026-10-12T15:12:08.068169Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117428579705148125", "record": "CVE-2026-103535", "field": "creation_timestamp", "uuid": "c497407b-7454-4478-afdd-a831066e62c4", "content": "CVE-2026-103535 CVE-2026-103535 Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as `../`. This enables an authenticated user with `UPDATE`-level permissions on `admin.configuration.language` to write files outside the expected `templates/` directory, including to web\u2011accessible paths. Separately, the translation\u2011writing logic does not escape `\\` in user\u2011supplied values, allowing inputs to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web\u2011server\u2019s privileges.\nhttps://www.cve.org/CVERecord?id=CVE-2026-103535https://kb.cert.org/vuls/id/162329#Thelia#CVE_2026_103535#bot", "url": "https://infosec.exchange/users/cve/statuses/117428579705148125"}, {"timestamp": "2026-10-12T15:17:06Z", "date_only": false, "value": "2026-10-12T15:17:06Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-QV6X-P59R-F4H3", "record": "GHSA-QV6X-P59R-F4H3", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T15:17:06.560Z", "date_only": false, "value": "2026-10-12T15:17:06.560", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103535", "record": "FKIE_CVE-2026-103535", "field": "published"}, {"timestamp": "2026-10-12T15:17:06.560Z", "date_only": false, "value": "2026-10-12T15:17:06.560", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103535", "record": "FKIE_CVE-2026-103535", "field": "lastModified"}, {"timestamp": "2026-10-12T15:32:21Z", "date_only": false, "value": "2026-10-12T15:32:21Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-QV6X-P59R-F4H3", "record": "GHSA-QV6X-P59R-F4H3", "field": "published"}, {"timestamp": "2026-10-12T15:32:21Z", "date_only": false, "value": "2026-10-12T15:32:21Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-QV6X-P59R-F4H3", "record": "GHSA-QV6X-P59R-F4H3", "field": "modified"}]}