CVE-2026-120248 in Thelia
Summary
by MITRE • 11/01/2026
Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file images. Attackers can upload an SVG with an onload payload served from /admin/store-media/logo or the public cache/images/store/ directory to execute scripts against visitors and higher-privileged administrators.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/01/2026
The vulnerability identified in Thelia versions prior to 3.1.1 represents a significant security flaw within the application's media handling subsystem, specifically affecting how SVG files are processed upon upload by authenticated users with store update permissions. This stored cross-site scripting (XSS) vector arises from an insufficient sanitization of input data when administrators attempt to customize their storefront branding elements such as logo_file or banner_file images. The core technical failure lies in the application's inability to properly validate and sanitize SVG content, which is inherently capable of embedding executable JavaScript code through event handlers like onload. Because Thelia stores these uploaded files directly within accessible directories without stripping malicious payloads, any script embedded within an SVG file remains active when the image is subsequently rendered by a web browser.
From an operational perspective, this vulnerability allows for persistent compromise because the injected scripts are stored on the server and served to every user who views the affected page. An attacker with administrative privileges can craft a malicious SVG containing JavaScript payloads that trigger upon loading, such as stealing session cookies, performing actions on behalf of the victim, or redirecting users to phishing sites. The impact is twofold: it affects regular visitors who view the storefront and potentially higher-privileged administrators if they access pages where these compromised images are displayed in the back-office interface. This persistence distinguishes stored XSS from reflected variants, as the malicious code executes automatically without requiring further interaction beyond viewing the page containing the infected image.
The attack vector is classified under CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, this instance involves Stored XSS where user input is saved to a database or file system and later retrieved for display in other users' browsers without adequate validation. In terms of the MITRE ATT&CK framework, this vulnerability aligns with techniques related to Client-side Injection and potentially Account Manipulation if used to escalate privileges by stealing administrative credentials via cookie theft. The specific path /admin/store-media/logo indicates that even internal management interfaces are susceptible if they render these images, expanding the blast radius beyond public-facing content.
Mitigation strategies must focus on immediate remediation of the input validation logic within Thelia's media upload functionality. Developers should implement strict allow-listing for SVG files rather than relying solely on extension checks or basic sanitization. This includes parsing the XML structure to remove any event handlers such as onload, onclick, or onerror attributes that can trigger script execution. Additionally, converting uploaded SVGs into raster formats like PNG or JPEG during processing is a robust defense-in-depth measure that eliminates the risk of embedded scripts entirely while preserving visual integrity for most use cases. For organizations unable to patch immediately, implementing Web Application Firewall rules that detect and block common XSS payloads in image uploads can provide temporary protection against exploitation until an official update to version 3.1.1 or later is deployed.