CVE-2026-125339

Winter CMS versions 1.0.319 through 1.2.13 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw because Backend\Classes\Controller::actionExists() allows public handler-shaped methods to be invoked via top-level GET requests. Since the system uses Route::any, CSRF validation is bypassed for...