---
id: "CVE-2026-120248"
kind: "vulnerability"
aliases: ["CVE-2026-120248"]
title: "Thelia: stored XSS via uploaded SVG store logos and banners"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["e-commerce", "php", "runtime", "self-hosted", "thelia"]
not_affected_if: ["no-back-office-store-editors", "version-3.1.1-or-later"]
published_at: "2026-11-01T01:17:18+00:00"
first_seen_at: "2026-11-01T01:47:22+00:00"
updated_at: "2026-11-01T01:47:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120248", "first_seen_at": "2026-11-01T01:47:22+00:00"}]
---

# Thelia: stored XSS via uploaded SVG store logos and banners

Thelia before 3.1.1 accepts SVG files for the store logo and banner without sanitizing them. A back-office administrator with store update permission can upload an SVG with a script in an onload attribute, which then runs in the browsers of visitors and higher-privileged administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Thelia version in `composer.json` or the Thelia admin footer; versions below `3.1.1` are affected.
- Look for uploaded `.svg` files under the store media directory and the public `cache/images/store/` directory.

## Fix

- Thelia `3.1.1` or later (per the sources, fixed in versions before 3.1.1 are vulnerable; the sources do not name the exact patched release line beyond 3.1.1).

## Timeline

- 2026-11-01T01:47:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120248

## From the sources

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file images. Attackers can upload an SVG with an onload payload served from /admin/store-media/logo or the public cache/images/store/ directory to execute scripts against visitors and higher-privileged administrators.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_