CVE-2026-120248 Thelia CVE debrief

Who should care

Defenders responsible for Thelia installations, administrators with store update permissions, and security teams monitoring for potential script injection attacks should assess exposure and apply patches or mitigations.

Why it matters

CVE-2026-120248 is a stored cross-site scripting vulnerability in Thelia before version 3.1.1 that allows authenticated administrators to inject scripts via SVG uploads, potentially leading to script execution against visitors and higher-privileged administrators. Defenders should prioritize verifying exposure, applying patches, and monitoring for suspicious activity.

• Potential script execution against visitors and higher-privileged administrators
• Possible unauthorized actions within the Thelia application
• Required verification of Thelia version and exposure
• Necessity for timely patch application or mitigation

Technical summary

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file images. Attackers can upload an SVG with an onload payload served from /admin/store-media/logo or the public cache/images/store/ directory to execute scripts against visitors and higher-privileged administrators. This vulnerability requires defenders to verify Thelia version, assess exposure, and apply patches or mitigations to prevent exploitation.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations to prevent exploitation.

Recommended defensive actions

• Verify Thelia version and apply patch 3.1.1 or later
• Restrict store update permissions to trusted administrators
• Monitor for suspicious SVG uploads and script execution
• Implement additional security measures for store media uploads
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is confirmed in Thelia versions before 3.1.1. Official sources provide details on the vulnerability and patches. Defenders should verify Thelia version, review official advisories, and apply patches or mitigations. Evidence is limited to public CVE details and vendor guidance. No additional exploit or vulnerability details are confirmed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.