Threats affecting pkg:composer/Thelia Back-office Default Twig Template

Thelia Back-office Default Twig Template versions prior to 1.1.1 contain a cross-site request forgery (CSRF) vulnerability in certain administrative routes that accept GET requests without anti-CSRF token validation. This flaw allows an attacker to trick a logged-in administrator into executing unauthorized actions such as modifying product combination prices, stock, weight, EAN, and sale flags, potentially zeroing omitted prices.

Thelia versions prior to 3.1.1 contain a stored cross-site scripting (XSS) vulnerability. Authenticated back-office administrators with store update permissions can exploit this by uploading unsanitized SVG images as logo or banner files. These SVG files can include malicious scripts that execute when accessed via the admin or public cache directories, potentially affecting visitors and higher-privileged administrators.

Thelia versions prior to 3.2.0 contain a cross-site request forgery (CSRF) vulnerability in the back office. This vulnerability arises because per-session CSRF tokens leak via URL query strings, allowing attackers to reuse these tokens or exploit unprotected actions. Specifically, attackers can target the setToggleVisibilityAction and updatePositionAction to perform unauthorized administrative actions such as deleting, hiding, or reordering catalogue and configuration objects. The issue is fixed in Thelia versions 3.2.0 and 1.2.0.