Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-120207— Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes

Quick assessment

Affected

Thelia Thelia Page Module

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Thelia Page 模块在 2.0.4 版本之前存在跨站请求伪造（CSRF）漏洞。该漏洞允许远程攻击者利用后台删除路由中缺失的 CSRF 令牌和权限检查，删除页面标签、文档和图片。攻击者可诱骗已登录的管理员访问精心构造的 GET 请求，通过遍历连续 ID，删除 TheliaLibrary 中的图片及其关联文件与变体，影响范围涵盖页面、产品和分类。

CVSS 7.1 · High Updated Nov 01, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Thelia	Thelia Page Module	`< 2.0.4`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes

Source: CVE Program / CVE List V5

Vulnerability Description

Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

跨站请求伪造(CSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Thelia	Thelia Page Module	0 ~ 2.0.4	-

II. Public POCs for CVE-2026-120207

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120207

请登录查看更多情报信息。

Other References for CVE-2026-120207 (4)

https://github.com/thelia-modules/Page/commit/e7206a7c35c945cc8fe529fe95a9b30402f0fb60 patch
https://github.com/thelia-modules/Page/blob/2.0.3/Controller/Admin/PageImageController.php#L117 technical-description
https://github.com/thelia/thelia/security/advisories/GHSA-whqr-4v2h-6jhc vendor-advisory third-party-advisory
https://www.vulncheck.com/advisories/thelia-page-module-before-2.0.4-csrf-via-page-tag-document-and-image-delete-routes third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120207

Same Patch Batch · Thelia · 2026-10-31 · 3 CVEs total

CVE-2026-120205	8.0 HIGH	Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name
CVE-2026-120206	5.9 MEDIUM	Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions

IV. Related Vulnerabilities

Same vendor: Thelia

Same weakness: CWE-352