Read the docs
TI-2026-55251 Aliases CVE-2026-79774GHSA-gw97-553p-fp3j

Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy

Priority MEDIUM 44CWE-693Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-693.

Summary

Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent models and query builders using methods like saveQuietly(), deleteQuietly(), increment(), decrement(), and newQuery() to read and modify arbitrary database records, execute arbitrary SQL, and achieve remote code execution by injecting PHP into template code sections.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00808 57th percentileScored 2026-11-07
Fix Fixed winter (wintercms): 1.2.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wintercmswinter1.2.7 to before 1.2.131.2.13Patch availableCNA
  • winter Vendorwintercms Affected 1.2.7 to before 1.2.13 Fixed in 1.2.13 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wintercms:winter:*:*:*:*:*:*:*:*——wintercms
  • cpe:2.3:a:wintercms:winter:*:*:*:*:*:*:*:* Versions — — ·wintercms

Remediation

  • Fix · CNA winter (wintercms) Fixed in 1.2.13

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    wintercms winter 1.2.13

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-55250 Winter CMS before 1.2.13 Local File Inclusion via JavaScriptPriority LOW 31
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-79774
  2. 2026-10-03 Alias added: GHSA-gw97-553p-fp3j

References

Patch 1

Advisory 1

  • TI-2024-19497 Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote… CVSS 3.1HIGH 7.2
  • TI-2023-28528 Winter CMS Local File Inclusion through Server Side Template Injection CVSS 3.1MEDIUM 5.4
  • TI-2022-18732 Winter vulnerable to Prototype Pollution in Snowboard framework CVSS 3.1CRITICAL 9.8
  • TI-2026-21979 Winter: Privilege escalation by authenticated backend users CVSS 3.1CRITICAL 10.0
  • TI-2024-21102 Dusk plugin may allow unfettered user authentication in misconfigured installs CVSS 3.1HIGH 8.8
  • TI-2024-36264 Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion CVSS 3.1HIGH 8.5
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences