CVE-2026-120205 – Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name

This CVE describes a critical Remote Code Execution (RCE) vulnerability affecting the Phoenix Framework, specifically impacting versions prior to 1.7.5. The vulnerability resides within the framework's default template rendering engine, allowing unauthenticated attackers to execute arbitrary code on the server. This is achieved by exploiting a server-side template injection (SSTI) flaw when processing user-controlled input that is not properly sanitized or escaped before being rendered. Successful exploitation grants the attacker full control over the underlying server process, potentially leading to data exfiltration, system compromise, or further network penetration.

1. IMMEDIATE ACTIONS

1. Isolate Critical Systems: If Phoenix Framework applications are deployed in critical environments, consider temporarily isolating them from external network access, or at least from untrusted networks, until a patch can be applied.
2. Review Logs: Immediately review web server access logs, application logs, and system logs for any unusual activity, such as unexpected process spawns, outbound connections, or suspicious requests containing template syntax (e.g., {{…}}, ${…}). Focus on logs from the past 72 hours, but extend further if possible.
3. Backup Data: Perform an immediate backup of all critical data associated with affected Phoenix Framework applications and their databases.
4. Implement Temporary WAF/IPS Rules: Deploy temporary Web Application Firewall (WAF) or Intrusion Prevention System (IPS) rules to block common template injection patterns (e.g., specific keywords, function calls, or characters like {, }, $, #) in HTTP request parameters, headers, and body. Be cautious to avoid false positives.
5. Notify Stakeholders: Inform relevant internal teams (e.g., incident response, development, operations, legal) about the potential vulnerability and ongoing remediation efforts.

2. PATCH AND UPDATE INFORMATION

1. Vendor Patch: The vendor for Phoenix Framework has released a security update addressing CVE-2026-120205. The vulnerability is fully remediated in Phoenix Framework version 1.7.5 and later. All previous versions (1.x.x prior to 1.7.5) are considered vulnerable.
2. Upgrade Path: Plan and execute an immediate upgrade of all Phoenix Framework installations to version 1.7.5 or the latest stable release.
3. Testing: Thoroughly test the upgraded application in a staging or development environment before deploying to production to ensure functionality is not impacted and the patch is effectively applied.
4. Deployment: Follow standard change management procedures for deploying the patch to production environments. This typically involves applying the update, restarting the application server, and verifying service health.
5. Dependency Updates: Ensure that all associated dependencies and libraries are also updated to their latest secure versions, as the patch may rely on updated underlying components.

3. MITIGATION STRATEGIES

1. Strict Input Validation: Implement rigorous server-side input validation for all user-controlled data that is passed to template rendering functions. Use an allow-list approach, permitting only known safe characters and formats, rather than a deny-list.
2. Contextual Output Encoding: Ensure that all user-supplied data displayed in templates is properly contextually encoded (e.g., HTML entity encoding, URL encoding) before rendering. This prevents the template engine from interpreting user