CVE-2026-120207

HIGH 7.1

Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories.

CWE	CWE-352
Vendor	thelia
Product	thelia page module
Published	Oct 31, 2026

Stay Ahead of the Next One

Get instant alerts for thelia thelia page module

Be the first to know when new high vulnerabilities affecting thelia thelia page module are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Affected Versions

Thelia / Thelia Page Module

0 < 2.0.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/thelia/thelia/security/advisories/GHSA-whqr-4v2h-6jhc github.com: https://github.com/thelia-modules/Page/commit/e7206a7c35c945cc8fe529fe95a9b30402f0fb60 github.com: https://github.com/thelia-modules/Page/blob/2.0.3/Controller/Admin/PageImageController.php#L117 vulncheck.com: https://www.vulncheck.com/advisories/thelia-page-module-before-2.0.4-csrf-via-page-tag-document-and-image-delete-routes

Credits

pnn219