---
id: CVE-2026-120207
title: >-
  Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete
  Routes
summary: >-
  Thelia Page Module before 2.0.4 contains a cross-site request forgery
  vulnerability that allows remote attackers to delete page tags, documents and
  images by abusing back-office delete routes lacking CSRF tokens and permission
  checks. At…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-352
vendor: Thelia
product: Thelia Page Module
affected:
  - page_module < 2.0.4
published: '2026-10-31'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T21:03:08.076Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120207'
references:
  - url: 'https://github.com/thelia/thelia/security/advisories/GHSA-whqr-4v2h-6jhc'
    label: GitHub Security Advisory (GHSA-whqr-4v2h-6jhc)
  - url: >-
      https://github.com/thelia-modules/Page/commit/e7206a7c35c945cc8fe529fe95a9b30402f0fb60
  - url: >-
      https://github.com/thelia-modules/Page/blob/2.0.3/Controller/Admin/PageImageController.php#L117
  - url: >-
      https://www.vulncheck.com/advisories/thelia-page-module-before-2.0.4-csrf-via-page-tag-document-and-image-delete-routes
    label: >-
      VulnCheck Advisory: Thelia Page Module before 2.0.4 CSRF via Page Tag,
      Document and Image Delete Routes
tags:
  - cve.org
epss: 0.00203
epssPercentile: 0.1036
ingestedAt: '2026-11-05T19:30:42.854Z'
---

## Overview

Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories.

## Affected

- `page_module < 2.0.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.