Vulnerabilities

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update…

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file images. Attackers can upload an SVG with an onload payload served from /admin/store-media/logo or the public cache/images/store/ directory to execute scripts against visitors and higher-privileged administrators.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Thelia

Product

Thelia, Thelia Core, Thelia Back-office Default Twig Template

CVSS v3.1

4.8 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness

CWE-79

Exposure class

Web platform

NVD status

Received

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-120248 on this site · NVD · CVE.org · Vulnpedia