{"id":"CVE-2026-120248","kind":"vulnerability","aliases":["CVE-2026-120248"],"related":[],"title":"Thelia: stored XSS via uploaded SVG store logos and banners","description":"Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file images. Attackers can upload an SVG with an onload payload served from /admin/store-media/logo or the public cache/images/store/ directory to execute scripts against visitors and higher-privileged administrators.","summary":"Thelia before 3.1.1 accepts SVG files for the store logo and banner without sanitizing them. A back-office administrator with store update permission can upload an SVG with a script in an onload attribute, which then runs in the browsers of visitors and higher-privileged administrators.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","php","runtime","self-hosted","thelia"],"not_affected_if":["no-back-office-store-editors","version-3.1.1-or-later"],"how_to_check":"- Check the installed Thelia version in `composer.json` or the Thelia admin footer; versions below `3.1.1` are affected.\n- Look for uploaded `.svg` files under the store media directory and the public `cache/images/store/` directory.","fix":"- Thelia `3.1.1` or later (per the sources, fixed in versions before 3.1.1 are vulnerable; the sources do not name the exact patched release line beyond 3.1.1).","status":"open","published_at":"2026-11-01T01:17:18+00:00","first_seen_at":"2026-11-01T01:47:22+00:00","triaged_at":"2026-11-01T01:47:44+00:00","updated_at":"2026-11-01T01:47:44+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-01T01:47:44Z","model":"claude-haiku-5-5","output":{"fix":"- Thelia `3.1.1` or later (per the sources, fixed in versions before 3.1.1 are vulnerable; the sources do not name the exact patched release line beyond 3.1.1).","reach":"network","title":"Thelia: stored XSS via uploaded SVG store logos and banners","impact":"medium","summary":"Thelia before 3.1.1 accepts SVG files for the store logo and banner without sanitizing them. A back-office administrator with store update permission can upload an SVG with a script in an onload attribute, which then runs in the browsers of visitors and higher-privileged administrators.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["thelia","php","e-commerce","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Scripts run in admin and visitor browsers, stealing sessions","analyst_note":"","how_to_check":"- Check the installed Thelia version in `composer.json` or the Thelia admin footer; versions below `3.1.1` are affected.\n- Look for uploaded `.svg` files under the store media directory and the public `cache/images/store/` directory.","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.1.1-or-later","no-back-office-store-editors"],"who_is_affected":"Thelia stores running a version before 3.1.1 where back-office users with store update permission can upload logo or banner files. The risk is to other administrators and site visitors who load the uploaded SVG. Stores that restrict who holds store update permission, or that do not allow SVG uploads, have a smaller exposure.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000717,"input_tokens":4167,"output_tokens":601,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120248':13A,16A '-2026':12A,15A '/admin/store-media/logo':120C '3.1.1':28B,76C 'accept':29B 'administr':45B,73B,91C,135C 'allow':86C 'attack':109C 'attribut':60B 'authent':87C 'back':43B,89C 'back-offic':42B,88C 'banner':10A,37B,106C 'browser':66B 'cache/images/store':124C 'commerc':19B 'contain':77C 'cross':81C 'cross-sit':80C 'cve':11A,14A 'directori':125C 'e':18B 'e-commerc':17B 'execut':127C 'file':31B,104C,107C 'higher':71B,133C 'higher-privileg':70B,132C 'host':24B 'imag':108C 'inject':97C 'logo':8A,35B,103C 'offic':44B,90C 'onload':59B,116C 'payload':117C 'permiss':49B,95C 'php':20B 'privileg':72B,134C 'public':123C 'run':63B 'runtim':21B 'sanit':39B 'script':56B,83C,98C,128C 'self':23B 'self-host':22B 'serv':118C 'site':82C 'store':2A,7A,34B,47B,79C,93C 'svg':6A,30B,53B,102C,113C 'thelia':1A,25B,26B,74C 'unsanit':101C 'updat':48B,94C 'upload':5A,51B,100C,111C 'via':4A 'visitor':68B,130C 'vulner':84C 'without':38B 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Thelia stores running a version before 3.1.1 where back-office users with store update permission can upload logo or banner files. The risk is to other administrators and site visitors who load the uploaded SVG. Stores that restrict who holds store update permission, or that do not allow SVG uploads, have a smaller exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T01:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120248","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120248","severity":null,"published_at":"2026-11-01T01:17:18+00:00","modified_at":"2026-11-01T01:17:18+00:00","first_seen_at":"2026-11-01T01:47:22+00:00","fetched_at":"2026-11-01T01:47:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}