Thelia CVE-2026-120205

Injection requires only a free, self-registered front-office customer account: the CustomerRegisterForm validates firstname/lastname with NotBlank only (no regex, no HTML stripping), so a script payload is stored raw in customer.firstname. Execution then requires a non-attacker-controlled precondition (the AT:P / UI:A gate): an administrator must attach a 'For one or more customers' (ForSomeCustomers) coupon condition referencing the attacker's customer, and must then load the coupon edit page or GET /admin/coupon/draw/conditionsSummaries/{couponId}, where ForSomeCustomers::getSummary() emits the unescaped name through a Twig {{ value|raw }} 'html' DataTable cell. Limiting factors: the payload only fires on this specific condition-summary path (the same record is correctly escaped everywhere else in the back office), it needs the admin to both configure that condition and view it, and it is confined to Thelia versions before 3.1.0. The chain to super-admin is aided by the absence of any Content-Security-Policy on admin pages and by admin CSRF tokens being embedded in page HTML (HttpOnly cookies do not block same-origin fetch of those tokens).

The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N, base 7.4 High) describes a network-reachable, unauthenticated-to-inject stored XSS (PR:N) whose severity is tempered by two real-world gates: AT:P (a specific precondition must exist) and UI:A (an administrator must act). The GHSA advisory from VulnCheck confirms the mechanism and documents a full, step-by-step PoC chain from self-registration to super-admin account creation, so the technical impact is genuinely high (VC:H/VI:H - confidentiality of all customer PII/orders and integrity via a persistent attacker-controlled admin account). However, the attack is not fire-and-forget: it depends on an administrator attaching a 'For one or more customers' coupon condition that references the attacker's customer record and then viewing that coupon's condition summary. There is no CISA KEV listing and no EPSS score was provided in the input, so there is no signal of active or widespread exploitation - the vuln.today decision label is 'this_week', not act_now/emergency. On balance this is a legitimately serious but conditional flaw: high impact and a detailed public PoC, offset by the admin-interaction requirement and a niche product footprint. Treat it as a this-week patching priority rather than an immediate emergency. Note that the input provides no EPSS value, so exploitation-probability cannot be compared against the KEV/PoC signals.

An unauthenticated attacker self-registers a front-office customer account, placing a script payload (e.g. '<svg onload=...>') in the firstname/lastname field, which the registration form stores verbatim. When an administrator later attaches a per-customer coupon condition referencing that account and opens the coupon in the back office, the payload executes in the authenticated /admin origin and, using CSRF tokens read from the admin page HTML, silently creates a new super-admin account. A detailed public PoC reference for this full chain exists in the GHSA advisory, though the input does not confirm it as packaged working exploit code; the network attack vector is offset by the required administrator interaction (UI:A).