{"id":"CVE-2026-120248","title":"Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads","summary":"Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file images. At…","severity":"medium","cvss":4.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"Thelia","product":"Thelia","affected":["Thelia < 3.1.1","core < 3.1.1","back-office_default_twig_template < 1.1.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-02T17:04:06.359779Z"},"published":"2026-11-01","updated":"2026-11-02","sourceUpdated":"2026-11-02T21:04:42.244Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120248","references":[{"url":"https://github.com/thelia/thelia/security/advisories/GHSA-gvcv-hvpp-89gx","label":"GitHub Security Advisory (GHSA-gvcv-hvpp-89gx)"},{"url":"https://github.com/thelia-templates/default-twig/commit/d79780eafc5b17ac75554c836a1853610d89a090"},{"url":"https://github.com/thelia-templates/default-twig/commit/f690a649cbbcee9543647cb7ed5018df68f66658"},{"url":"https://github.com/thelia/thelia/commit/2c691e5c3bb8536ca901fcf7d2780301bd111ba9"},{"url":"https://github.com/thelia/thelia/releases/tag/3.1.1","label":"Thelia 3.1.1 Release Notes"},{"url":"https://github.com/thelia-templates/default-twig/blob/6473c164bd86348f4c7d0ef6f194f1ff3d267902/src/Controller/Configuration/ConfigStoreController.php#L173-L195"},{"url":"https://www.vulncheck.com/advisories/thelia-before-3.1.1-stored-xss-via-svg-store-logo-and-banner-uploads","label":"VulnCheck Advisory: Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads"}],"tags":["cve.org"],"epss":0.00239,"epssPercentile":0.15058,"ingestedAt":"2026-11-05T19:30:42.854Z","slug":"CVE-2026-120248","body":"## Overview\n\nThelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file images. Attackers can upload an SVG with an onload payload served from /admin/store-media/logo or the public cache/images/store/ directory to execute scripts against visitors and higher-privileged administrators.\n\n## Affected\n\n- `Thelia < 3.1.1`\n- `core < 3.1.1`\n- `back-office_default_twig_template < 1.1.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":26.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}