Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling… (CVE-2026-103527)

The vulnerability in Thelia v2.6.0 involves improper escaping of double quotes in the “next” parameter within the Smarty templates address.html and address-update.html. This flaw enables reflected Cross-Site Scripting (XSS) attacks by allowing attacker-controlled JavaScript to be executed in the context of an authenticated user's browser when they access a maliciously crafted URL.

An attacker can exploit this vulnerability to execute arbitrary JavaScript in the context of an authenticated user's session. This may lead to session hijacking, unauthorized actions performed on behalf of the user, or other attacks that rely on executing malicious scripts in the victim's browser.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on suspicious links containing the “next” parameter in Thelia v2.6.0. Implementing web application firewall (WAF) rules to detect and block XSS payloads may provide temporary mitigation.