CVE-2026-120248

Name of the Vulnerable Software and Affected Versions Thelia versions prior to 3.1.1

Description A stored cross-site scripting issue exists where authenticated back-office administrators with store update permissions can inject scripts. This occurs by uploading unsanitized SVG images via the logo file or banner file variables. The malicious scripts, using an onload payload, are served from the '/admin/store-media/logo' endpoint or the 'public cache/images/store/' directory, allowing execution against visitors and higher-privileged administrators.

Recommendations Update to version 3.1.1 or later. Restrict the upload of SVG files for the logo file and banner file variables until the update is applied.