Reflected Cross-Site Scripting Vulnerability in Thelia by Thelia Team

CVE-2026-103527

What is CVE-2026-103527?

Thelia v2.6.0 contains a vulnerability in its Smarty templates, specifically in the 'address.html' and 'address-update.html' files. The issue arises from improper escaping of double quotes in the 'next' parameter, which allows an attacker to inject malicious JavaScript. When an authenticated user clicks on a specially crafted link, the injected script is executed in their browser, potentially leading to unauthorized actions or data exposure.

References