CVE-2026-120248 Details
Description
Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file images. Attackers can upload an SVG with an onload payload served from /admin/store-media/logo or the public cache/images/store/ directory to execute scripts against visitors and higher-privileged administrators.
A stored cross-site scripting vulnerability has been identified in Thelia versions prior to 3.1.1. This vulnerability allows authenticated back-office administrators with store update permissions to inject scripts by uploading unsanitized SVG images as logos or banners. The uploaded SVGs can contain payloads that execute scripts when the image is accessed, affecting both regular visitors and administrators with higher privileges.
Users are advised to update to Thelia version 3.1.1 or later, and to update the back-office default twig template to version 1.1.1. After updating, run the command 'php bin/console image-cache:clear' to clear the image cache.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 1, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Thelia | >= 0, < 3.1.1 |
CPE
Remediation
| |
| Thelia Core | >= 0, < 3.1.1 |
CPE
Remediation
| |
| Thelia Back-office Default Twig Template | >= 0, < 1.1.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Nov 1, 2026 | New CVE Received | [email protected] |