CVE-2026-103527
Received Received - Intake

Reflected XSS in Thelia v2.6.0 Smarty Templates

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: CERT/CC

Description
Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting (XSS) when an authenticated user visits the malicious link containing attacker‑controlled JavaScript.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-103527
EUVD
EUVD-2026-97479

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Thelia Thelia 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Thelia v2.6.0 has a reflected Cross-Site Scripting (XSS) vulnerability in its Smarty templates (address.html and address-update.html). The issue occurs because double quotes in the 'next' parameter are not properly escaped, allowing attackers to inject malicious JavaScript code via a crafted link.

Detection Guidance

To detect this vulnerability, inspect Thelia v2.6.0 Smarty templates (address.html and address-update.html) for improper escaping of the 'next' parameter. Check for reflected XSS by testing if double quotes in the 'next' parameter trigger JavaScript execution when visited by an authenticated user.

Impact Analysis

An attacker could trick an authenticated user into clicking a malicious link, executing arbitrary JavaScript in their browser. This could lead to session hijacking, data theft, or unauthorized actions on behalf of the user.

Compliance Impact

This XSS vulnerability could expose user data, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. It may lead to unauthorized access, data breaches, and non-compliance penalties.

Mitigation Strategies

Immediately update Thelia to a patched version that properly escapes the 'next' parameter in Smarty templates. If an update is unavailable, manually patch the templates to escape double quotes in the 'next' parameter to prevent XSS.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103527. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart