CVE-2026-120207
Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows…
- Risk score
- 48/100
- CVSS
- 7.1 v3.1
- Published
- 31 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.0.4 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.1 high
- Remotely exploitable without logging in
References
- https://github.com/thelia-modules/Page/blob/2.0.3/Controller/Admin/PageImageController.php#L117
- https://github.com/thelia-modules/Page/commit/e7206a7c35c945cc8fe529fe95a9b30402f0fb60
- https://github.com/thelia/thelia/security/advisories/GHSA-whqr-4v2h-6jhc
- https://www.vulncheck.com/advisories/thelia-page-module-before-2.0.4-csrf-via-page-tag-document-and-image-delete-routes
Original description
Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories.
Last activity 31 Oct 2026. Patch Forecast updates every hour.