Thelia Thelia Back-office Default Twig Template

• CVE-2026-120249 Medium 6.5 Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes 0.1%
• CVE-2026-120248 Medium 4.8 Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads 0.2%
• CVE-2026-120206 Medium 5.9 Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions 0.1%