Thelia vulnerabilities
We track 7 vulnerabilities in Thelia products across 3 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on October 31, 2026.
Latest Thelia vulnerabilities
- 7.1 High severity
Thelia Page Module: Cross-Site Request Forgery
Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logg
- 8.0 High severity
Thelia: Improper Neutralization of Input During Web Page Generation
Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that exe
- 7.2 High severity
Thelia: Unrestricted Upload of File with Dangerous Type
Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileMa
- 8.8 High severity
Thelia: Improper Control of Generation of Code
Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By
- 8.8 High severity
Thelia: Improper Control of Generation of Code
Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The `item_name` parameter, used to build the translation file's write path, does not sanitize directory
- 7.2 High severity
Thelia: Unrestricted Upload of File with Dangerous Type
In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achie
- 7.2 High severity
Thelia: Unrestricted Upload of File with Dangerous Type
In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to uplo