Read the docs
TI-2022-18732 Aliases CVE-2022-39357GHSA-3fh5-q6fg-w28q

Winter vulnerable to Prototype Pollution in Snowboard framework

Priority MEDIUM 46CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is vulnerable to prototype pollution in the main Snowboard class as well as its plugin loader. The 1.0 branch of Winter is not affected, as it does not contain the Snowboard framework. This issue has been patched in v1.1.10 and v1.2.1. As a workaround, one may avoid this issue by following some common security practices for JavaScript, including implementing a content security policy and auditing scripts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01366 71st percentileScored 2026-11-07
Fix Fixed winter (wintercms): 1.1.10wintercms/winter (Packagist): 1.1.10, 1.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wintercmswinter1.1.8 to before 1.1.10; = 1.2.01.1.10Patch availableCNA
—wintercms/winter (Packagist)1.1.8 to before 1.1.101.1.10Patch availableGHSA-3fh5-q6fg-w28q
—wintercms/winter (Packagist)1.2.0 to before 1.2.11.2.1Patch availableGHSA-3fh5-q6fg-w28q
  • winter Vendorwintercms Affected 1.1.8 to before 1.1.10; = 1.2.0 Fixed in 1.1.10 Patch available CNA
  • wintercms/winter (Packagist) Vendor— Affected 1.1.8 to before 1.1.10 Fixed in 1.1.10 Patch available GHSA-3fh5-q6fg-w28q
  • wintercms/winter (Packagist) Vendor— Affected 1.2.0 to before 1.2.1 Fixed in 1.2.1 Patch available GHSA-3fh5-q6fg-w28q

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:wintercms:winter:1.1.8:*:*:*:*:*:*:*1.1.8Vulnerablewintercms
cpe:2.3:a:wintercms:winter:1.1.9:*:*:*:*:*:*:*1.1.9Vulnerablewintercms
cpe:2.3:a:wintercms:winter:1.2.0:*:*:*:*:*:*:*1.2.0Vulnerablewintercms
  • cpe:2.3:a:wintercms:winter:1.1.8:*:*:*:*:*:*:* Versions 1.1.8 Vulnerable ·wintercms
  • cpe:2.3:a:wintercms:winter:1.1.9:*:*:*:*:*:*:* Versions 1.1.9 Vulnerable ·wintercms
  • cpe:2.3:a:wintercms:winter:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·wintercms

Remediation

  • Fix · CNA winter (wintercms) Fixed in 1.1.10
  • Fix · GHSA-3fh5-q6fg-w28q wintercms/winter (Packagist) Fixed in 1.1.10 Advisory →
  • Fix · GHSA-3fh5-q6fg-w28q wintercms/winter (Packagist) Fixed in 1.2.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-39357
  2. 2026-10-03 Alias added: GHSA-3fh5-q6fg-w28q

References

Patch 3

Advisory 3

Other 1

  • TI-2024-19497 Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote… CVSS 3.1HIGH 7.2
  • TI-2023-28528 Winter CMS Local File Inclusion through Server Side Template Injection CVSS 3.1MEDIUM 5.4
  • TI-2026-21979 Winter: Privilege escalation by authenticated backend users CVSS 3.1CRITICAL 10.0
  • TI-2024-36264 Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion CVSS 3.1HIGH 8.5
  • TI-2023-18899 Winter CMS vulnerable to stored XSS through privileged upload of SVG file CVSS 3.1MEDIUM 4.8
  • TI-2023-28527 Winter CMS Stored XSS through Backend ColorPicker FormWidget CVSS 3.1MEDIUM 5.4
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences