Read the docs
TI-2024-36264 Aliases CVE-2024-54149GHSA-xhw3-4j3m-hq53

Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion

Priority LOW 39CWE-184Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on Twig files and modify resources such as theme customisation values or modify, or remove, templates in the theme even if not provided direct access via the permissions. As all objects passed through to Twig are references to the live objects, it is also possible to also manipulate model data if models are passed directly to Twig, including changing attributes or even removing records entirely. In most cases, this is unwanted behavior and potentially dangerous. To actively exploit this security issue, an attacker would need access to the Backend with a user account with any of the following permissions: `cms.manage_layouts`; `cms.manage_pages`; or `cms.manage_partials`. The Winter CMS maintainers strongly recommend that these permissions only be reserved to trusted administrators and developers in general. The maintainers of Winter CMS have significantly increased the scope of the sandbox, effectively making all models and datasources read-only in Twig, in versions 1.2.7, 1.1.11, and 1.0.476. Thse who cannot upgrade may apply commit fb88e6fabde3b3278ce1844e581c87dcf7daee22 to their Winter CMS installation manually to resolve the issue. In the rare event that a Winter user was relying on being able to write to models/datasources within their Twig templates, they should instead use or create components to make changes to their models.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0042 36th percentileScored 2026-11-07
Fix Fixed winter (wintercms): 1.2.7, 1.1.11, 1.0.476winter/wn-cms-module (Packagist): 1.2.7, 1.1.11, 1.0.476

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wintercmswinter1.2.0 to before 1.2.7; 1.1.0 to before 1.1.11; before 1.0.4761.2.7, 1.1.11, 1.0.476Patch availableCNA
—winter/wn-cms-module (Packagist)1.2.0 to before 1.2.71.2.7Patch availableGHSA-xhw3-4j3m-hq53
—winter/wn-cms-module (Packagist)1.1.0 to before 1.1.111.1.11Patch availableGHSA-xhw3-4j3m-hq53
—winter/wn-cms-module (Packagist)before 1.0.4761.0.476Patch availableGHSA-xhw3-4j3m-hq53
  • winter Vendorwintercms Affected 1.2.0 to before 1.2.7; 1.1.0 to before 1.1.11; before 1.0.476 Fixed in 1.2.7, 1.1.11, 1.0.476 Patch available CNA
  • winter/wn-cms-module (Packagist) Vendor— Affected 1.2.0 to before 1.2.7 Fixed in 1.2.7 Patch available GHSA-xhw3-4j3m-hq53
  • winter/wn-cms-module (Packagist) Vendor— Affected 1.1.0 to before 1.1.11 Fixed in 1.1.11 Patch available GHSA-xhw3-4j3m-hq53
  • winter/wn-cms-module (Packagist) Vendor— Affected before 1.0.476 Fixed in 1.0.476 Patch available GHSA-xhw3-4j3m-hq53

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wintercms:winter:*:*:*:*:*:*:*:*before 1.0.476; 1.1.0 to before 1.1.11; 1.2.0 to before 1.2.7Vulnerablewintercms
  • cpe:2.3:a:wintercms:winter:*:*:*:*:*:*:*:* Versions before 1.0.476; 1.1.0 to before 1.1.11; 1.2.0 to before 1.2.7 Vulnerable ·wintercms

Remediation

  • Fix · CNA winter (wintercms) Fixed in 1.2.7, 1.1.11, 1.0.476
  • Fix · GHSA-xhw3-4j3m-hq53 winter/wn-cms-module (Packagist) Fixed in 1.2.7 Advisory →
  • Fix · GHSA-xhw3-4j3m-hq53 winter/wn-cms-module (Packagist) Fixed in 1.1.11 Advisory →
  • Fix · GHSA-xhw3-4j3m-hq53 winter/wn-cms-module (Packagist) Fixed in 1.0.476 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-54149
  2. 2026-10-03 Alias added: GHSA-xhw3-4j3m-hq53

References

Patch 1

Advisory 2

Other 1

  • TI-2024-19497 Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote… CVSS 3.1HIGH 7.2
  • TI-2023-28528 Winter CMS Local File Inclusion through Server Side Template Injection CVSS 3.1MEDIUM 5.4
  • TI-2022-18732 Winter vulnerable to Prototype Pollution in Snowboard framework CVSS 3.1CRITICAL 9.8
  • TI-2026-21979 Winter: Privilege escalation by authenticated backend users CVSS 3.1CRITICAL 10.0
  • TI-2023-18899 Winter CMS vulnerable to stored XSS through privileged upload of SVG file CVSS 3.1MEDIUM 4.8
  • TI-2023-28527 Winter CMS Stored XSS through Backend ColorPicker FormWidget CVSS 3.1MEDIUM 5.4
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences