CVE-2026-120248 PUBLISHED

Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads

Assigner: VulnCheck
Reserved: 31.10.2026 Published: 01.11.2026 Updated: 01.11.2026

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file images. Attackers can upload an SVG with an onload payload served from /admin/store-media/logo or the public cache/images/store/ directory to execute scripts against visitors and higher-privileged administrators.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS Score: 4.6

Product Status

Vendor Thelia
Product Thelia
Versions Default: unaffected
  • affected from 0 to 3.1.1 (excl.)
Vendor Thelia
Product Thelia Core
Versions Default: unaffected
  • affected from 0 to 3.1.1 (excl.)
Vendor Thelia
Product Thelia Back-office Default Twig Template
Versions Default: unaffected
  • affected from 0 to 1.1.1 (excl.)

Credits

  • pnn219 finder

References

Problem Types

  • Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE