Stored Cross-Site Scripting Flaw in Thelia E-commerce Platform
CVE-2026-120248
4.6MEDIUM
Key Information:
- Vendor
Thelia
- Vendor
- CVE Published:
- 1 November 2026
What is CVE-2026-120248?
Thelia versions prior to 3.1.1 are susceptible to a stored cross-site scripting vulnerability. This issue arises from the ability of authenticated back-office administrators, who have store update permissions, to upload unsanitized SVG images as logo or banner files. Attackers could exploit this by uploading a specially crafted SVG with an onload payload, allowing them to execute malicious scripts against site visitors and potentially compromise higher-privileged administrators. It is critical for users of affected versions to update to version 3.1.1 or later to mitigate this risk.
Affected Version(s)
Thelia 0 < 3.1.1
Thelia Back-office Default Twig Template 0 < 1.1.1
Thelia Core 0 < 3.1.1