Thelia vulnerabilities

Newest CVEs

• CVE-2026-120249

  Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes

  Thelia · Thelia Back-office Default Twig Template

  Medium6.9
• CVE-2026-120248

  Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads

  Thelia · Thelia

  Medium4.6
• CVE-2026-120207

  Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes

  Thelia · Thelia Page Module

  High7.0
• CVE-2026-120206

  Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions

  Thelia · Thelia

  Medium5.9
• CVE-2026-120205

  Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name

  Thelia · Thelia

  High7.4
• CVE-2026-112285

  Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders

  Thelia · Thelia

  Medium5.3
• CVE-2026-109397

  Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space

  Thelia · Thelia

  High8.6
• CVE-2026-109396

  Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports

  Thelia · Thelia

  Low2.3
• CVE-2026-107248

  CVE-2026-107248

  Thelia · Thelia

  High8.8
• CVE-2026-103537

  CVE-2026-103537

  Thelia · Thelia

  Medium5.4