Thelia CVE-2026-103527

Exploitation requires the victim to be an authenticated Thelia 2.6.0 user who clicks an attacker-supplied link whose 'next' parameter contains a double quote that escapes the quoting of a Smarty-rendered attribute in address.html or address-update.html; the injected JavaScript only executes when these specific account/address pages are loaded in the victim's logged-in session. Limiting factors: the attack needs user interaction (clicking the crafted link), the target page requires an active authenticated session to render, and only Thelia instances at or below version 2.6.0 are affected. The attacker themselves needs no credentials or privileges to generate the link.

This is a textbook moderate-severity reflected XSS (CWE-79), and the signals are internally consistent in pointing to LOW real-world urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) reflects network reachability and low complexity but is gated by required user interaction (UI:R) and yields only Low confidentiality/integrity impact with no availability effect. EPSS corroborates low risk: 0.16% probability at the 4th percentile, indicating no meaningful mass-exploitation signal. There is no CISA KEV listing and no POC referenced in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision record was supplied. One nuance to flag explicitly: the CVSS vector carries PR:N (which the precision rules map to 'unauthenticated'), yet the description states the victim must be 'an authenticated user' - these are not actually in conflict, because CVSS PR describes ATTACKER privileges (the attacker needs none to craft the link) while the description describes the VICTIM's session state (the vulnerable address.html/address-update.html pages only render for a logged-in user). This should be understood as attacker-unauthenticated but victim-authenticated, not treated as a data error. Overall: a genuine but low-priority bug - patch in normal cycles, not an emergency.

An attacker crafts a URL to a Thelia 2.6.0 store's address or address-update page with a malicious 'next' parameter that breaks out of a double-quoted Smarty-rendered attribute and injects JavaScript. The attacker delivers this link (phishing, forum post, chat) to a logged-in customer; when the victim opens it, the script executes in their authenticated session context. No public exploit code is referenced in the available data, though the single-parameter reflected nature makes a working payload trivial to construct.