CVE-2026-103524
4.8MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
An authenticated administrator can execute arbitrary JavaScript in the browsers of users or other admins viewing category and product pages. Exploitation requires network access, admin privileges to submit malicious input, and victim interaction to view the affected page.
Root cause
Thelia fails to sanitize or output-encode user-supplied input when creating categories and products, allowing stored script payloads to render in admin and storefront pages.
Affected systems
Thelia v2.6.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Fix & remediation
Upgrade to a fixed version beyond v2.6.0 if available from the vendor. If an update cannot be applied immediately, restrict administrative interface access to trusted IP addresses and audit product/category inputs for raw HTML or script tags.
$ composer show thelia/theliaAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store's product pages, allowing arbitrary JavaScript execution when the affected pages are viewed. The vulnerability affects multiple administrative functions including category creation and product creation.