Versions 2.6.0 and 2.6.1 of Thelia, an e-commerce platform, contain numerous security flaws. These vulnerabilities span file management, templating, module installation, and administrative functions. Exploits can lead to remote code execution, server-side template injection, and cross-site scripting. Some issues allow administrative users to upload malicious files, enabling code execution on the server. The store banner upload feature also has insufficient validation, allowing PHP files disguised as images to be uploaded. An open redirect vulnerability exists in the address creation workflow, allowing attackers to redirect users to malicious sites. Stored XSS vulnerabilities in the administrative interface permit JavaScript execution when affected pages are viewed. Username enumeration is possible due to differing error responses for invalid credentials. Reflected XSS can occur in Smarty templates by failing to escape double quotes. Email templates lack proper restriction of dangerous PHP functions, enabling arbitrary command execution. Module installation without validation allows the inclusion of malicious PHP code. Version 2.6.1 has path traversal and PHP code injection vulnerabilities in its translation editor, leading to remote code execution. An absolute path traversal in Smarty template handling enables server-side template injection and RCE. No patch is currently available, so users should restrict administrative access and disable file upload features.