CVE-2026-79774 Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy

Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\Twig\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent...

PT-2026-81363

Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in SystemTwigSecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent models...

CVE-2026-79774: Protection Mechanism Failure

Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\Twig\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent...

CVE-2026-79773: Improper Limitation of a Pathname to a Restricted Directory

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manageassets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can...

PT-2026-81362

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage assets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers ca...

Winter: Reflected XSS through the search query parameter in the backend Table widget

Impact Affected versions of Winter CMS render the search query parameter without HTML encoding inside a block in the backend Table widget partial modules/backend/widgets/table/partials/table.php: php value="" is an HTML raw-text context, so the surrounding value="…" attribute quoting is not a...

Winter: CSRF through AJAX handler names reachable as backend page actions

Impact Affected versions of Winter CMS allow a backend AJAX handler to be invoked by a plain top-level GET navigation with no CSRF token. Backend\Classes\Controller::actionExists accepted any public method on a controller as a page action, so handler-shaped names were never reserved from URL...

GHSA-5CWR-5JXG-PCF6 Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles

Impact Users with the backend.managebranding "Customize the back-end" or backend.manageeditor "Manage global code editor preferences" permission can provide custom CSS through Settings → Customize Backend → Styles or Settings → Editor Settings → Markup Styles that is compiled through the LESS CSS...

Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles

Impact Users with the backend.managebranding "Customize the back-end" or backend.manageeditor "Manage global code editor preferences" permission can provide custom CSS through Settings → Customize Backend → Styles or Settings → Editor Settings → Markup Styles that is compiled through the LESS CSS...

GHSA-FM29-4MQ3-PHG6 Winter: ImportExportController AJAX handlers bypass granular import/export permission gate

Impact Affected versions of Winter CMS did not enforce the ImportExportController behavior's granular access control on the handlers that actually perform the work. The behavior supports per-operation access control through the importpermissions and exportpermissions configuration keys, enforced ...

Winter: ImportExportController AJAX handlers bypass granular import/export permission gate

Impact Affected versions of Winter CMS did not enforce the ImportExportController behavior's granular access control on the handlers that actually perform the work. The behavior supports per-operation access control through the importpermissions and exportpermissions configuration keys, enforced ...

GHSA-MPMW-F6H6-3G26 Winter: My Account preview exposes another backend user's profile by record ID

Impact Backend\Controllers\MyAccount, introduced in v1.2.13, declares an empty $requiredPermissions array so that any authenticated backend user can manage their own account. It implements the FormController behavior, which exposes three routable actions — create, update and preview — that each...

Winter: My Account preview exposes another backend user's profile by record ID

Impact Backend\Controllers\MyAccount, introduced in v1.2.13, declares an empty $requiredPermissions array so that any authenticated backend user can manage their own account. It implements the FormController behavior, which exposes three routable actions — create, update and preview — that each...

Winter: Stored XSS through Backend List widget image columns

Impact Backend\Widgets\Lists::evalImageTypeValue interpolated the resolved image URL into a single-quoted src attribute without escaping it. Where a list column of type image rendered an attacker-influenced value, that value could break out of the attribute and inject arbitrary attributes —...

GHSA-8CFW-PCWH-V63W Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)

Impact Affected versions of Winter CMS allow authenticated backend users with CMS template-editing permissions to escape the Twig sandbox "safe mode" that is meant to restrict what template code can do. Using any of the following permissions, an attacker can read and modify arbitrary database...

Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)

Impact Affected versions of Winter CMS allow authenticated backend users with CMS template-editing permissions to escape the Twig sandbox "safe mode" that is meant to restrict what template code can do. Using any of the following permissions, an attacker can read and modify arbitrary database...

GHSA-2223-F22X-24CQ Winter: Local File Inclusion through =include directives in JavaScript asset compilation

Impact Affected versions of Winter CMS allow authenticated backend users with the cms.manageassets permission "Manage website assets - images, JavaScript files, CSS files" to disclose arbitrary files readable by the PHP process by placing an =include / =require directive in a theme JavaScript...

Winter: Local File Inclusion through =include directives in JavaScript asset compilation

Impact Affected versions of Winter CMS allow authenticated backend users with the cms.manageassets permission "Manage website assets - images, JavaScript files, CSS files" to disclose arbitrary files readable by the PHP process by placing an =include / =require directive in a theme JavaScript...

GHSA-58FP-MCX6-7QF9 Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets

Impact Affected versions of Winter CMS allow authenticated backend users with the following permissions to disclose arbitrary files readable by the PHP process by injecting @import inline "" directives into LESS source that the backend compiles. Four entry points share the same root cause: - Bran...

Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets

Impact Affected versions of Winter CMS allow authenticated backend users with the following permissions to disclose arbitrary files readable by the PHP process by injecting @import inline "" directives into LESS source that the backend compiles. Four entry points share the same root cause: - Bran...