Read the docs
TI-2026-55250 Aliases CVE-2026-79773GHSA-gqr6-9g7c-7g7r

Winter CMS before 1.2.13 Local File Inclusion via JavaScript

Priority LOW 31CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can reference files like .env outside the theme directory, and the combined output served through the combine route becomes readable by unauthenticated visitors, exposing application keys and database credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00493 42nd percentileScored 2026-11-07
Fix Fixed winter (wintercms): 1.2.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wintercmswinterbefore 1.2.131.2.13Patch availableCNA
  • winter Vendorwintercms Affected before 1.2.13 Fixed in 1.2.13 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wintercms:winter:*:*:*:*:*:*:*:*——wintercms
  • cpe:2.3:a:wintercms:winter:*:*:*:*:*:*:*:* Versions — — ·wintercms

Remediation

  • Fix · CNA winter (wintercms) Fixed in 1.2.13

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    wintercms winter 1.2.13

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-55251 Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicyPriority MEDIUM 44
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-79773
  2. 2026-10-03 Alias added: GHSA-gqr6-9g7c-7g7r

References

Patch 2

Advisory 1

  • TI-2024-19497 Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote… CVSS 3.1HIGH 7.2
  • TI-2023-28528 Winter CMS Local File Inclusion through Server Side Template Injection CVSS 3.1MEDIUM 5.4
  • TI-2022-18732 Winter vulnerable to Prototype Pollution in Snowboard framework CVSS 3.1CRITICAL 9.8
  • TI-2026-55251 Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy CVSS 4.0CRITICAL 9.3
  • TI-2026-21979 Winter: Privilege escalation by authenticated backend users CVSS 3.1CRITICAL 10.0
  • TI-2024-21102 Dusk plugin may allow unfettered user authentication in misconfigured installs CVSS 3.1HIGH 8.8
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences