Threats tagged 'ghsa-h2jf-7chq-2q39'

The Thelia Page Module versions prior to 2.0.4 contain a cross-site request forgery (CSRF) vulnerability. This flaw allows remote attackers to delete page tags, documents, and images by exploiting back-office delete routes that lack CSRF tokens and permission checks. Attackers can trick logged-in administrators into visiting crafted GET requests that sequentially delete TheliaLibrary images and associated files across pages, products, and categories.