Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: wintercms winter 1.2.13 Clear all filters
TI-2026-55251 CVE-2026-79774 · GHSA-gw97-553p-fp3j

Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy

Priority MEDIUM 44

Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sand…

CVSS 4.0CRITICAL 9.3 Network High privileges User interaction EPSS 0.00808 Published 2026-08-25 Fixed in 1.2.13 CWE-693
TI-2026-55250 CVE-2026-79773 · GHSA-gqr6-9g7c-7g7r

Winter CMS before 1.2.13 Local File Inclusion via JavaScript

Priority LOW 31

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by pla…

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00493 Published 2026-08-25 Fixed in 1.2.13 CWE-22