# Thelia vulnerabilities Source: https://junglewise.ai/threats/vendors/thelia Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 1 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/thelia.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 19 vulnerabilities in Thelia: 5 in the last 7 days and 18 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-120249, was published on 1 November 2026. 13 vulnerabilities in the last four weeks, up from none in the four before. 1 technology has a page of its own. ## Counts - Last 7 days: 5 - Last 30 days: 18 - Last 90 days: 18 - All time: 19 (0 critical, 0 exploited in the wild) ## About Thelia Thelia is a software vendor specializing in e-commerce solutions and content management systems. ## Latest Thelia vulnerabilities - [CVE-2026-120249: Thelia Back-office Default Twig Template cross-site request forgery](https://junglewise.ai/threats/cve-2026-120249-thelia-back-office-default-twig-template-before-1-1-1-contains-a) (medium, CVSS 6.5, published 1 Nov 2026) - [CVE-2026-120248: Thelia stored cross-site scripting in store media upload](https://junglewise.ai/threats/cve-2026-120248-thelia-before-3-1-1-contains-a-stored-cross-site-scripting) (medium, CVSS 4.8, published 1 Nov 2026) - [CVE-2026-120207: Thelia Page Module CSRF in image deletion](https://junglewise.ai/threats/cve-2026-120207-thelia-page-module-before-2-0-4-contains-a-cross-site-request) (high, CVSS 7.1, published 31 Oct 2026) - [CVE-2026-120206: Thelia CSRF vulnerability in back office administrative actions](https://junglewise.ai/threats/cve-2026-120206-thelia-before-3-2-0-contains-a-cross-site-request-forgery) (medium, CVSS 5.9, published 31 Oct 2026) - [CVE-2026-120205: Thelia stored cross-site scripting in coupon condition summary](https://junglewise.ai/threats/cve-2026-120205-thelia-before-3-1-0-contains-a-stored-cross-site-scripting) (high, CVSS 8, published 31 Oct 2026) - [CVE-2026-112285: Thelia coupon usage limit bypass](https://junglewise.ai/threats/cve-2026-112285-thelia-before-3-1-5-and-3-2-x-before-3-2-4-contains-a-business) (medium, CVSS 4.3, published 19 Oct 2026) - [CVE-2026-109397: Thelia unrestricted file upload via trailing space bypass](https://junglewise.ai/threats/cve-2026-109397-thelia-before-3-1-2-and-3-2-x-before-3-2-1-contains-an) (high, CVSS 7.2, published 12 Oct 2026) - [CVE-2026-109396: Thelia CSV formula injection in exports](https://junglewise.ai/threats/cve-2026-109396-thelia-before-3-1-2-and-3-2-x-before-3-2-1-contains-a-csv) (medium, CVSS 4.2, published 12 Oct 2026) - [CVE-2026-107248: Thelia back-office Email/Messages server-side template injection](https://junglewise.ai/threats/cve-2026-107248-thelia-3-0-0-s-back-office-email-messages-feature-contains-a) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2026-103537: Thelia absolute path traversal in Smarty template handling](https://junglewise.ai/threats/cve-2026-103537-thelia-2-6-1-contains-an-absolute-path-traversal-vulnerability) (medium, CVSS 5.4, published 12 Oct 2026) - [CVE-2026-103535: Thelia path traversal and PHP code injection in translation editor](https://junglewise.ai/threats/cve-2026-103535-thelia-v2-6-1-contains-path-traversal-and-php-code-injection) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2026-103529: Thelia remote code execution in module installation](https://junglewise.ai/threats/cve-2026-103529-thelia-v2-6-0-permits-authenticated-administrators-to-upload-and) (medium, CVSS 5.4, published 12 Oct 2026) - [CVE-2026-103528: Thelia email templates RCE via Smarty function access](https://junglewise.ai/threats/cve-2026-103528-thelia-2-6-0-uses-smarty-for-email-templates-without-properly) (medium, CVSS 5.4, published 12 Oct 2026) - [CVE-2026-103527: Thelia reflected XSS in address form next parameter](https://junglewise.ai/threats/cve-2026-103527-thelia-v2-6-0-s-smarty-templates-address-html-and-address-update) (info, published 12 Oct 2026) - [CVE-2026-103524: Thelia stored XSS in administrative interface](https://junglewise.ai/threats/cve-2026-103524-thelia-v2-6-0-is-vulnerable-to-multiple-stored-xss) (info, published 12 Oct 2026) - [CVE-2026-103523: Thelia open redirect in address creation workflow](https://junglewise.ai/threats/cve-2026-103523-thelia-v2-6-0-contains-an-open-redirect-vulnerability-in-its) (info, published 12 Oct 2026) - [CVE-2026-103522: Thelia store banner upload insufficient MIME validation](https://junglewise.ai/threats/cve-2026-103522-in-thelia-v2-6-0-the-store-banner-upload-feature-performs) (high, CVSS 7.2, published 12 Oct 2026) - [CVE-2026-103521: Thelia document update arbitrary file upload](https://junglewise.ai/threats/cve-2026-103521-in-thelia-v2-6-0-the-document-upload-endpoint-properly-blocks) (high, CVSS 7.2, published 12 Oct 2026) - [Thelia authentication bypass for customer and admin accounts](https://junglewise.ai/threats/thelia-authentication-bypass-for-customer-and-admin-accounts-096a0e97) (high, CVSS 7.5, published 30 May 2024) ## Most severe Thelia vulnerabilities - [CVE-2026-103535: Thelia path traversal and PHP code injection in translation editor](https://junglewise.ai/threats/cve-2026-103535-thelia-v2-6-1-contains-path-traversal-and-php-code-injection) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2026-107248: Thelia back-office Email/Messages server-side template injection](https://junglewise.ai/threats/cve-2026-107248-thelia-3-0-0-s-back-office-email-messages-feature-contains-a) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2026-120205: Thelia stored cross-site scripting in coupon condition summary](https://junglewise.ai/threats/cve-2026-120205-thelia-before-3-1-0-contains-a-stored-cross-site-scripting) (high, CVSS 8, published 31 Oct 2026) - [Thelia authentication bypass for customer and admin accounts](https://junglewise.ai/threats/thelia-authentication-bypass-for-customer-and-admin-accounts-096a0e97) (high, CVSS 7.5, published 30 May 2024) - [CVE-2026-103521: Thelia document update arbitrary file upload](https://junglewise.ai/threats/cve-2026-103521-in-thelia-v2-6-0-the-document-upload-endpoint-properly-blocks) (high, CVSS 7.2, published 12 Oct 2026) - [CVE-2026-103522: Thelia store banner upload insufficient MIME validation](https://junglewise.ai/threats/cve-2026-103522-in-thelia-v2-6-0-the-store-banner-upload-feature-performs) (high, CVSS 7.2, published 12 Oct 2026) - [CVE-2026-109397: Thelia unrestricted file upload via trailing space bypass](https://junglewise.ai/threats/cve-2026-109397-thelia-before-3-1-2-and-3-2-x-before-3-2-1-contains-an) (high, CVSS 7.2, published 12 Oct 2026) - [CVE-2026-120207: Thelia Page Module CSRF in image deletion](https://junglewise.ai/threats/cve-2026-120207-thelia-page-module-before-2-0-4-contains-a-cross-site-request) (high, CVSS 7.1, published 31 Oct 2026) - [CVE-2026-120249: Thelia Back-office Default Twig Template cross-site request forgery](https://junglewise.ai/threats/cve-2026-120249-thelia-back-office-default-twig-template-before-1-1-1-contains-a) (medium, CVSS 6.5, published 1 Nov 2026) - [CVE-2026-120206: Thelia CSRF vulnerability in back office administrative actions](https://junglewise.ai/threats/cve-2026-120206-thelia-before-3-2-0-contains-a-cross-site-request-forgery) (medium, CVSS 5.9, published 31 Oct 2026) ## Vulnerabilities per week 13 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 3 Aug 2026 | 0 | 0 | 0 | | 10 Aug 2026 | 0 | 0 | 0 | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 12 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 5 | 0 | 0 | ## Thelia technologies - [Thelia](https://junglewise.ai/threats/technologies/thelia): 17 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Thelia vulnerabilities", https://junglewise.ai/threats/vendors/thelia, 1 November 2026.