CVE-2026-120249— Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes

Quick assessment

Affected

Thelia Thelia Back-office Default Twig Template

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Thelia 后台在 1.1.1 版本之前使用的默认 Twig 模板存在跨站请求伪造（CSRF）漏洞。该漏洞影响和路由，这些路由接受 GET 请求但未进行反 CSRF 令牌验证。攻击者可诱骗已登录的管理员访问精心构造的链接，从而篡改产品组合的价格、库存、重量、EAN 编码及销售标志；对于未明确指定的价格，攻击者还可将其清零。

CVSS 6.5 · Medium Updated Nov 01, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Thelia	Thelia Back-office Default Twig Template	`< 1.1.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes

Source: CVE Program / CVE List V5

Vulnerability Description

Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrator into following a crafted link to rewrite product combination prices, stock, weight, EAN and sale flags, zeroing omitted prices.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

跨站请求伪造(CSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Thelia	Thelia Back-office Default Twig Template	0 ~ 1.1.1	-

II. Public POCs for CVE-2026-120249

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120249

请登录查看更多情报信息。

Other References for CVE-2026-120249 (5)

https://github.com/thelia-templates/default-twig/commit/aaf540ca552dbc4c63dca77620af4b7936d22e8f patch
https://github.com/thelia-templates/default-twig/commit/51b014b06a5b4ee45f15093aa58a3064d4412bd3 patch
https://github.com/thelia-templates/default-twig/blob/6473c164bd86348f4c7d0ef6f194f1ff3d267902/src/Controller/Catalog/ProductAdvancedController.php#L546-L599 technical-description
https://github.com/thelia/thelia/security/advisories/GHSA-j2c3-9c4q-c2ch vendor-advisory third-party-advisory
https://www.vulncheck.com/advisories/thelia-back-office-default-twig-template-before-1.1.1-csrf-via-product-combination-routes third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120249

IV. Related Vulnerabilities

Same vendor: Thelia

Same weakness: CWE-352