{"metadata": {"vulnerability": "cve-2026-109397", "count": 15, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-06T10:16:07Z", "date_only": false, "value": "2026-10-06T10:16:07.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-109397", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-12T14:40:48.115Z", "date_only": false, "value": "2026-10-12T14:40:48.115Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-109397", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T15:16:43.107Z", "date_only": false, "value": "2026-10-12T15:16:43.107Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-109397", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T15:16:43.107Z", "date_only": false, "value": "2026-10-12T15:16:43.107Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "cve-2026-109397", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T15:37:27.673Z", "date_only": false, "value": "2026-10-12T15:37:27.673699Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117428679286140576", "record": "CVE-2026-109397", "field": "creation_timestamp", "uuid": "bf3e283f-bb96-466e-8554-9472f1649857", "content": "CVE-2026-109397 Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109397https://github.com/thelia/thelia/security/advisories/GHSA-5524-qfxp-33v9https://github.com/thelia/thelia/commit/6b706f5cb96e6b12d890c6d16edb1c9d1fd8191ahttps://github.com/thelia/thelia/commit/b71258902b5dd278007d0f37ddad45f76d06d5bchttps://github.com/thelia/thelia/blob/3.2.0/core/lib/Thelia/Core/File/Service/FileProcessorService.php#L119-L160https://github.com/thelia/thelia/releases/tag/3.1.2https://github.com/thelia/thelia/releases/tag/3.2.1https://www.vulncheck.com/advisories/thelia-before-3.1.2-and-3.2-x-before-3.2.1-file-upload-rce-via-filename-trailing-space#Thelia#CVE_2026_109397#bot", "url": "https://infosec.exchange/users/cve/statuses/117428679286140576"}, {"timestamp": "2026-10-12T16:17:05Z", "date_only": false, "value": "2026-10-12T16:17:05Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-HJXM-GPW4-W4Q7", "record": "GHSA-HJXM-GPW4-W4Q7", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-12T16:17:05.233Z", "date_only": false, "value": "2026-10-12T16:17:05.233", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109397", "record": "FKIE_CVE-2026-109397", "field": "published"}, {"timestamp": "2026-10-12T18:31:34Z", "date_only": false, "value": "2026-10-12T18:31:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-HJXM-GPW4-W4Q7", "record": "GHSA-HJXM-GPW4-W4Q7", "field": "published"}, {"timestamp": "2026-10-12T18:31:34Z", "date_only": false, "value": "2026-10-12T18:31:34Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-HJXM-GPW4-W4Q7", "record": "GHSA-HJXM-GPW4-W4Q7", "field": "modified"}, {"timestamp": "2026-10-13T04:10:05.355Z", "date_only": false, "value": "2026-10-13T04:10:05.355715Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxq5yo2vro2q", "record": "CVE-2026-109397", "field": "creation_timestamp", "uuid": "5393d978-e763-4c61-b060-9c9b89f5eeaa", "content": "CVE-2026-109397 - thelia\nIn Thelia versions earlier than 3.1.2 and 3.2.1, a back\u2011office user can add a space to the end of a file name and upload a PHP file that the system saves as an executable script. This lets the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#thelia #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxq5yo2vro2q"}, {"timestamp": "2026-10-13T16:40:48.601Z", "date_only": false, "value": "2026-10-13T16:40:48.601402Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-109397", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-13T16:40:48.601Z", "date_only": false, "value": "2026-10-13T16:40:48.601402Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109397", "record": "FKIE_CVE-2026-109397", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T16:57:16.106Z", "date_only": false, "value": "2026-10-13T16:57:16.106Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-109397", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-13T16:57:16.106Z", "date_only": false, "value": "2026-10-13T16:57:16.106Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-109397", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T20:41:35.943Z", "date_only": false, "value": "2026-10-13T20:41:35.943", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109397", "record": "FKIE_CVE-2026-109397", "field": "lastModified"}]}