CVE-2026-120248— Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads
Quick assessment
Affected
Thelia Thelia
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Thelia 3.1.1 之前的版本存在存储型跨站脚本（Stored XSS）漏洞。拥有商店更新权限的已认证后台管理员可通过上传未经过滤的 SVG 格式 logo_file 或 banner_file 图片来注入恶意脚本。攻击者可以上传包含 onload 载荷的 SVG 文件，该文件由 或公共缓存目录 提供，从而在访客及更高权限管理员的浏览器中执行恶意脚本。
Affected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Thelia | Thelia | < 3.1.1 |
affected |
| Thelia | Thelia Back-office Default Twig Template | < 1.1.1 |
affected |
| Thelia | Thelia Core | < 3.1.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-120248
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads
Source: CVE Program / CVE List V5
Vulnerability Description
Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file images. Attackers can upload an SVG with an onload payload served from /admin/store-media/logo or the public cache/images/store/ directory to execute scripts against visitors and higher-privileged administrators.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Thelia | Thelia | 0 ~ 3.1.1 | - |
|
| Thelia | Thelia Core | 0 ~ 3.1.1 | - |
|
| Thelia | Thelia Back-office Default Twig Template | 0 ~ 1.1.1 | - |
|
II. Public POCs for CVE-2026-120248
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-120248
请登录查看更多情报信息。
Other References for CVE-2026-120248 (7)
-
https://github.com/thelia/thelia/releases/tag/3.1.1 release-notes
IV. Related Vulnerabilities
Same product: Thelia
-
CVE-2026-120206
Thelia before 3.2.0 Back-Office CSRF via URL Token and Unpro -
CVE-2026-120205
Thelia before 3.1.0 Stored XSS via Coupon Condition Customer -
CVE-2026-112285
Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via -
CVE-2026-109397
Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE v -
CVE-2026-109396
Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injec
Same vendor: Thelia
-
CVE-2026-120249
Thelia Back-office Default Twig Template before 1.1.1 CSRF v -
CVE-2026-120207
Thelia Page Module before 2.0.4 CSRF via Page Tag, Document -
CVE-2026-120206
Thelia before 3.2.0 Back-Office CSRF via URL Token and Unpro -
CVE-2026-120205
Thelia before 3.1.0 Stored XSS via Coupon Condition Customer -
CVE-2026-112285
Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via
Same weakness: CWE-79
-
CVE-2026-66570
WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site -
CVE-2026-113429
Gitea stored XSS through legacy Actions artifact Content-Enc -
CVE-2026-120218
Typemill SvgSanitizer.php saveImage cross site scripting -
CVE-2026-120190
PostyBirb Plus Submission Description Editor DescriptionInpu -
CVE-2026-120205
Thelia before 3.1.0 Stored XSS via Coupon Condition Customer