Read the docs
TI-2026-83557 Aliases CVE-2026-120207GHSA-h2jf-7chq-2q39

CSRF in Thelia Page Module delete routes lets attackers remove images

Priority MEDIUM 64CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Tampering
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

Thelia Page Module before 2.0.4 contains a cross-site request forgery flaw, CWE-352. Its back-office delete routes for page tags, documents and images lack CSRF tokens and permission checks, so a remote attacker can lure a logged-in administrator into following crafted GET requests. Successful attacks delete page tags, documents and TheliaLibrary images along with their files and variants across pages, products and categories.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00203 10th percentileScored 2026-11-07
Fix Fixed Thelia Page Module (Thelia): 2.0.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TheliaThelia Page Modulebefore 2.0.42.0.4Patch availableCNA
  • Thelia Page Module VendorThelia Affected before 2.0.4 Fixed in 2.0.4 Patch available CNA

Remediation

Update Thelia Page Module to version 2.0.4 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Thelia Page Module (Thelia) Fixed in 2.0.4

Timeline

  1. 2026-10-31 Threatist record created from CVE-2026-120207
  2. 2026-10-31 Alias added: GHSA-h2jf-7chq-2q39
  3. 2026-11-02 Priority changed: MEDIUM → LOW
  4. 2026-11-06 CISA SSVC decision points changed
  5. 2026-11-06 Priority changed: LOW → MEDIUM

References

Patch 1

Advisory 1

Other 1

  • TI-2026-83555 Stored cross-site scripting in Thelia via coupon customer names CVSS 4.0HIGH 7.4
  • TI-2026-83574 Cross-site request forgery in Thelia back-office product combination routes CVSS 4.0MEDIUM 6.9
  • TI-2026-83556 Thelia back office CSRF via leaked URL tokens and unprotected actions CVSS 4.0MEDIUM 5.9
  • TI-2026-71031 CSV formula injection in Thelia exports lets visitors run spreadsheet formulas CVSS 4.0LOW 2.3
  • TI-2026-71005 Thelia translation editor flaws allow remote code execution CVSS 3.1HIGH 8.8
  • TI-2026-71032 Unrestricted file upload in Thelia allows PHP code execution CVSS 4.0HIGH 8.6
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences