Threats affecting pkg:composer/Thelia Page Module

The Thelia Page Module before version 2.0.4 contains a cross-site request forgery (CSRF) vulnerability. This flaw allows remote attackers to delete page tags, documents, and images by exploiting back-office delete routes that lack CSRF tokens and permission checks. An attacker can trick a logged-in administrator into visiting crafted GET requests that sequentially delete TheliaLibrary images and associated files across pages, products, and categories. The vulnerability is fixed in version 2.0.4.