CVE-2026-103523
Quick assessment
Affected
Thelia Thelia
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Thelia v2.6.0 在其地址创建流程中存在开放重定向漏洞。用户在访问特制的 URL 并成功提交“添加新地址”表单后，应用程序会将用户重定向到 参数中指定的 URL。由于该应用程序未验证目标 URL 是否属于同一源或受信任的允许列表，攻击者可以构造任意外部 URL，从而将用户重定向至攻击者控制的网站。
Possible ATT&CK Techniques 1 AI
T1566.002 · Spearphishing Link
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-103523
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CVE-2026-103523
Source: CVE Program / CVE List V5
Vulnerability Description
Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the `next` parameter. Because the application does not validate whether the destination belongs to the same origin or an approved allowlist, an attacker can supply an arbitrary external URL and redirect users to an attacker-controlled website.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-103523
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-103523
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-103523 (1)
Same Patch Batch · Thelia · 2026-10-12 · 13 CVEs total
| CVE-2026-109397 | 7.2 HIGH | Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space |
| CVE-2026-109396 | 4.2 MEDIUM | Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports |
| CVE-2026-103521 | CVE-2026-103521 | |
| CVE-2026-103524 | CVE-2026-103524 | |
| CVE-2026-103522 | CVE-2026-103522 | |
| CVE-2026-103526 | CVE-2026-103526 | |
| CVE-2026-103529 | CVE-2026-103529 | |
| CVE-2026-103537 | CVE-2026-103537 | |
| CVE-2026-103528 | CVE-2026-103528 | |
| CVE-2026-103527 | CVE-2026-103527 | |
| CVE-2026-103535 | CVE-2026-103535 | |
| CVE-2026-107248 | CVE-2026-107248 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-103523
No comments yet