Live › vulnerability › CVE-2026-120248
Thelia before 3.1.1 accepts SVG files for the store logo and banner without sanitizing them. A back-office administrator with store update permission can upload an SVG with a script in an onload attribute, which then runs in the browsers of visitors and higher-privileged administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 01:47 UTC. All times on this page are UTC.
Thelia stores running a version before 3.1.1 where back-office users with store update permission can upload logo or banner files. The risk is to other administrators and site visitors who load the uploaded SVG. Stores that restrict who holds store update permission, or that do not allow SVG uploads, have a smaller exposure.
No product ranges from the sources yet.
composer.json or the Thelia admin footer; versions below 3.1.1 are affected..svg files under the store media directory and the public cache/images/store/ directory.3.1.1 or later (per the sources, fixed in versions before 3.1.1 are vulnerable; the sources do not name the exact patched release line beyond 3.1.1).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file images. Attackers can upload an SVG with an onload payload served from /admin/store-media/logo or the public cache/images/store/ directory to execute scripts against visitors and higher-privileged administrators.
This page as .md · .json · in your agent: get_signal("CVE-2026-120248")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.