Thelia Page Module
Monthly
Thelia Page Module through 2.0.3 exposes back-office delete routes for page tags, documents and images without CSRF tokens or permission checks, so a logged-in administrator can be lured through a top-level GET navigation into deleting these records and their files. The page-image route resolves ids against the global TheliaLibrary media store, allowing sequential ids to remove shop-wide assets used by pages, products and categories. The advisory includes a proof-of-concept walkthrough; active exploitation is not confirmed by CISA KEV, and the vendor fixed the issue in 2.0.4.
Thelia Page Module through 2.0.3 exposes back-office delete routes for page tags, documents and images without CSRF tokens or permission checks, so a logged-in administrator can be lured through a top-level GET navigation into deleting these records and their files. The page-image route resolves ids against the global TheliaLibrary media store, allowing sequential ids to remove shop-wide assets used by pages, products and categories. The advisory includes a proof-of-concept walkthrough; active exploitation is not confirmed by CISA KEV, and the vendor fixed the issue in 2.0.4.