CVE-2026-103527

6.1Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.1Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Remote attackers can execute arbitrary JavaScript in an authenticated user's browser session. Exploitation requires convincing a logged-in user to click a crafted link targeting the application.

Root cause

Thelia's address.html and address-update.html Smarty templates fail to escape double quotes passed into the next parameter.

Affected systems

Thelia v2.6.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade to a patched version once released by the vendor, or manually sanitize the "next" parameter output inside address.html and address-update.html to escape double quotes.

shell

$ grep -rn 'next' templates/ | grep -E 'address(-update)?\.html'

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting (XSS) when an authenticated user visits the malicious link containing attacker‑controlled JavaScript.

References

https://kb.cert.org/vuls/id/162329

Source: nvd.nist.gov/vuln/detail/CVE-2026-103527