back-office_default_twig_template vulnerabilities
CVEs whose affected-version data names the back-office_default_twig_template package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-120249Medium· 6.5PoCThelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes
Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CS…
CVE-2026-120248Medium· 4.8Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads
Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file images. At…
CVE-2026-120206Medium· 5.9PoCThelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions
Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked token…