Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…thelia/security/advisories/GHSA-whqr-4v2h-6jhc Üretici bülteni
• github.com/…ommit/e7206a7c35c945cc8fe529fe95a9b30402f0fb60 Yama
• vulncheck.com/…-via-page-tag-document-and-image-delete-routes Üçüncü taraf
• github.com/…2.0.3/Controller/Admin/PageImageController.php Diğer

Kayıt geçmişi

1. 31 Eki 2026 20:25Yayımlandı

İlgili açıklar

• 5,9 CVE-2026-120206Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions
• 10,0 CVE-2026-61826Bazarr Plex OAuth API uç noktaları kimlik doğrulamasız erişime açık
• 5,4 CVE-2026-119466WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) vulnerability
• 8,8 CVE-2026-65566AI Engine WordPress eklentisinde CSRF açığı (3.8.8 ve öncesi)
• 6,5 CVE-2026-45141Chamilo LMS: CSRF in destructive skill-management AJAX actions
• 4,3 CVE-2026-112374FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API