CVE-2026-120248

MEDIUM 4.8

Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads

CVSS Score

4.8

EPSS Score

0.0%

EPSS Percentile

0th

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file images. Attackers can upload an SVG with an onload payload served from /admin/store-media/logo or the public cache/images/store/ directory to execute scripts against visitors and higher-privileged administrators.

CWE	CWE-79
Vendor	thelia
Product	thelia
Published	Nov 1, 2026

Stay Ahead of the Next One

Get instant alerts for thelia thelia

Be the first to know when new medium vulnerabilities affecting thelia thelia are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

Thelia / Thelia

0 < 3.1.1

Thelia / Thelia Core

0 < 3.1.1

Thelia / Thelia Back-office Default Twig Template

0 < 1.1.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/thelia/thelia/security/advisories/GHSA-gvcv-hvpp-89gx github.com: https://github.com/thelia-templates/default-twig/commit/d79780eafc5b17ac75554c836a1853610d89a090 github.com: https://github.com/thelia-templates/default-twig/commit/f690a649cbbcee9543647cb7ed5018df68f66658 github.com: https://github.com/thelia/thelia/commit/2c691e5c3bb8536ca901fcf7d2780301bd111ba9 github.com: https://github.com/thelia/thelia/releases/tag/3.1.1 github.com: https://github.com/thelia-templates/default-twig/blob/6473c164bd86348f4c7d0ef6f194f1ff3d267902/src/Controller/Configuration/ConfigStoreController.php#L173-L195 vulncheck.com: https://www.vulncheck.com/advisories/thelia-before-3.1.1-stored-xss-via-svg-store-logo-and-banner-uploads

Credits

pnn219