AI analysis
Thelia v2.6.0, an open-source PHP e-commerce platform, contains an open redirect vulnerability in its customer address creation workflow. After a victim follows a crafted link and submits the 'Add New Address' form, the application redirects them to whatever URL is placed in the 'next' parameter, with no same-origin or allowlist validation. An attacker can leverage this for phishing, credential harvesting, or malware distribution by sending victims malicious links that appear to originate from a trusted store. Sites running Thelia 2.6.0 (and per CERT-FR, 2.6.1 is also affected by multiple vulnerabilities) are at risk. No public proof of concept or observed in-the-wild exploitation is known, and the CVE is not in CISA's KEV catalog.
What to do: Upgrade to the latest Thelia release (CERT-FR flags both 2.6.0 and 2.6.1 as vulnerable to multiple issues, so apply the vendor's fixed version as soon as it is available). In the meantime, validate or drop the 'next' parameter by enforcing same-origin checks, and monitor server logs for suspicious redirect parameters in address-creation requests. Warn customers that legitimate order/address flows will never redirect them to third-party sites.
Estimated exposure
nicheunknown; likely thousands of deployments at most — Thelia is a niche open-source PHP e-commerce CMS with no public active-install or exposed-host counts available, so deployment scale is estimated low based on its limited market presence relative to mainstream platforms.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the `next` parameter. Because the application does not validate whether the destination belongs to the same origin or an approved allowlist, an attacker can supply an arbitrary external URL and redirect users to an attacker-controlled website.