CVE-2026-103527 in Thelia
Summary
by MITRE • 10/12/2026
Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting (XSS) when an authenticated user visits the malicious link containing attacker‑controlled JavaScript.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Thelia version 2.6.0 represents a classic instance of Reflected Cross-Site Scripting within its template rendering engine, specifically affecting the Smarty-based address management modules. The core technical flaw resides in how the application processes the next parameter during user authentication and redirection flows. When an authenticated user interacts with the address.html or address-update.html templates, the system accepts input for the next step of a process but fails to apply adequate output encoding before injecting this value into the HTML context. This lack of proper escaping allows double quotes within the payload to break out of their intended string boundaries, thereby enabling the injection and subsequent execution of arbitrary JavaScript code in the victim's browser session.
From an operational perspective, this vulnerability poses a significant risk to user data integrity and confidentiality because it requires authentication. While reflected XSS typically targets unauthenticated users through phishing links, the requirement for prior login here expands the attack surface to include privileged actions or sensitive account management features. An attacker can craft a malicious URL containing script tags within the next parameter and trick an authenticated administrator or customer into visiting it via social engineering techniques such as email spoofing or compromised referral links. Upon execution, the injected scripts run with the same privileges as the legitimate application code, potentially allowing session hijacking through cookie theft, credential harvesting by redirecting users to phishing sites that mimic Thelia’s login interface, or performing unauthorized actions on behalf of the victim using their active session tokens.
This flaw aligns directly with CWE-79, which categorizes improper neutralization of input during web page generation as a Cross-Site Scripting vulnerability. The specific mechanism involves insufficient validation and encoding of user-supplied data before it is rendered in an HTML context, allowing script injection. In terms of the MITRE ATT&CK framework, this behavior corresponds to T1059.007, which denotes JavaScript execution within web browsers as a technique for client-side code injection. The attacker leverages the trusted relationship between the user and the Thelia application domain to bypass same-origin policy restrictions, effectively turning the legitimate website into a vector for delivering malicious payloads without triggering typical browser security warnings associated with external domains.
Mitigation strategies must focus on implementing robust input validation and output encoding mechanisms within the Smarty template configuration or custom plugins handling these specific pages. Developers should ensure that all dynamic content derived from user parameters is strictly encoded using context-aware escaping functions provided by the framework, specifically targeting HTML entity encoding for attributes and text nodes to prevent tag injection. Additionally, enforcing Content Security Policy headers can provide a layer of defense-in-depth by restricting script execution sources, although this serves as a compensating control rather than a fix for the underlying code defect. Upgrading to patched versions where these templates have been reviewed for secure coding practices is essential, alongside conducting regular security audits and penetration testing focused on parameter manipulation in authenticated workflows to identify similar encoding oversights across other modules.