Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets

Impact Affected versions of Winter CMS allow authenticated backend users with the following permissions to disclose arbitrary files readable by the PHP process by injecting @import inline "" directives into LESS source that the backend compiles. Four entry points share the same root cause: - Bran...

Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

Impact The backend FileUpload form widget trusted an attacker-controlled fileid POST parameter when resolving the attachment it operates on. The lookup FileUpload::getFileRecord resolved the posted id against the global systemfiles table without verifying that the file belonged to the widget's ow...

GHSA-3277-H8G9-QJ5F Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

Impact The backend FileUpload form widget trusted an attacker-controlled fileid POST parameter when resolving the attachment it operates on. The lookup FileUpload::getFileRecord resolved the posted id against the global systemfiles table without verifying that the file belonged to the widget's ow...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the FileUpload process. An attacker can gain unauthorized access to and modify metadata and ordering of attachments belonging to other users by submitting crafted fileid parameters to...

PT-2026-80786

Impact Affected versions of Winter CMS allow authenticated backend users with the following permissions to disclose arbitrary files readable by the PHP process by injecting @import inline "" directives into LESS source that the backend compiles. Four entry points share the same root cause: - Bran...

GHSA-J5JQ-CR68-V2XX Winter: Authenticated backend users can bypass Users controller permission checks

Impact Affected versions of Winter CMS did not validate the handler name submitted through the form postback mechanism handler POST field in the same way as AJAX requests XWINTERREQUESTHANDLER header. The AJAX path validates that handler names match the onA-Z\w+ pattern, but the postback path...

Winter: Authenticated backend users can bypass Users controller permission checks

Impact Affected versions of Winter CMS did not validate the handler name submitted through the form postback mechanism handler POST field in the same way as AJAX requests XWINTERREQUESTHANDLER header. The AJAX path validates that handler names match the onA-Z\w+ pattern, but the postback path...

Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

Impact Affected versions of Winter CMS did not enforce per-template-type permission checks in the CMS section's AJAX handlers. The CMS controller Cms\Controllers\Index used OR-logic across its five permissions cms.managepages, cms.managepartials, cms.managelayouts, cms.managecontent,...

GHSA-5C4F-9PQ9-6C77 Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

Impact Affected versions of Winter CMS did not enforce per-template-type permission checks in the CMS section's AJAX handlers. The CMS controller Cms\Controllers\Index used OR-logic across its five permissions cms.managepages, cms.managepartials, cms.managelayouts, cms.managecontent,...

Improper Handling of Insufficient Permissions or Privileges

Overview Affected versions of this package are vulnerable to Improper Handling of Insufficient Permissions or Privileges in the Cms\Controllers\Index process. An attacker can gain unauthorized access to template types and upload assets by crafting AJAX requests with insufficient permission checks...

Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax

Impact The Backend Filter widget Backend\Widgets\Filter is vulnerable to SQL injection through the numberrange scope type when the scope is configured with a conditions key. An authenticated backend user with access to a list view containing a vulnerable filter scope can inject arbitrary SQL via...

GHSA-M7JC-G4RC-JMVH Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax

Impact The Backend Filter widget Backend\Widgets\Filter is vulnerable to SQL injection through the numberrange scope type when the scope is configured with a conditions key. An authenticated backend user with access to a list view containing a vulnerable filter scope can inject arbitrary SQL via...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection in the numberrange scope of the backend filter widget when the conditions key is configured. An attacker can access sensitive database information by injecting arbitrary SQL through the filter's AJAX handler. This is only...

GHSA-VGP4-2FC4-QFF2 Winter: Stored XSS through Editor Settings custom styles

Impact Authenticated Backend Users with the backend.manageeditor "Manage editor settings" permission can provide custom styles through Settings → Editor Settings → Markup Styles that are compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was n...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the renderCss process. An attacker can inject malicious scripts by providing crafted custom styles through the editor settings interface, which are then rendered on backend pages. This is only exploitable if...

Winter: Stored XSS through Editor Settings custom styles

Impact Authenticated Backend Users with the backend.manageeditor "Manage editor settings" permission can provide custom styles through Settings → Editor Settings → Markup Styles that are compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was n...

Winter: Stored XSS through Brand Settings custom styles

Impact Users with the backend.managebranding "Customize the back-end" permission can provide custom CSS through Settings → Customize Backend → Styles that is compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was not sanitized, which could hav...

GHSA-V7CF-8GH9-GXMJ Winter: Stored XSS through Brand Settings custom styles

Impact Users with the backend.managebranding "Customize the back-end" permission can provide custom CSS through Settings → Customize Backend → Styles that is compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was not sanitized, which could hav...

PT-2026-76556

Name of the Vulnerable Software and Affected Versions Winter CMS versions prior to 1.2.13 Description An issue exists where the backend fails to validate the handler name submitted via the handler POST field during form postbacks. While AJAX requests are validated against the onA-Zw+ pattern, the...

PT-2026-76552

Name of the Vulnerable Software and Affected Versions Winter versions prior to 1.2.13 Description Custom CSS provided through the Brand Settings Styles field is compiled by the LESS parser and rendered without sanitization on every backend page. This allows a user with the backend.manage branding...