Vulnerabilities

TI-2026-45085 CVE-2026-63179 · GHSA-58fp-mcx6-7qf9

Path traversal in wintercms winter

LOW 23

Winter CMS is a content management system built on the Laravel PHP framework.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00515 Published 2026-08-26 Fixed in 1.2.13 CWE-22

TI-2026-39156 CVE-2026-54256 · GHSA-3277-h8g9-qj5f

Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

LOW 24

Winter CMS is a content management system built on the Laravel PHP framework.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00239 Published 2026-08-26 Fixed in 1.2.13 CWE-284

TI-2026-25148 CVE-2026-32639 · GHSA-5c4f-9pq9-6c77

Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

LOW 30

Winter CMS is a content management system built on the Laravel PHP framework.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00459 Published 2026-08-26 Fixed in 1.2.13 CWE-289

TI-2026-25103 CVE-2026-32593 · GHSA-m7jc-g4rc-jmvh

Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax

LOW 26

Winter CMS is a content management system built on the Laravel PHP framework.

CVSS 3.1MEDIUM 5.9 Network Low privileges No interaction EPSS 0.00274 Published 2026-08-26 Fixed in 1.2.13 CWE-89

TI-2026-24787 CVE-2026-32258 · GHSA-vgp4-2fc4-qff2

Winter: Stored XSS through Editor Settings custom styles

LOW 37

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.

CVSS 3.1HIGH 8.1 Network High privileges User interaction EPSS 0.00382 Published 2026-08-26 Fixed in 1.2.13 CWE-79

TI-2026-24786 CVE-2026-32257 · GHSA-v7cf-8gh9-gxmj

Winter: Stored XSS through Brand Settings custom styles

LOW 37

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.

CVSS 3.1HIGH 8.1 Network High privileges User interaction EPSS 0.00382 Published 2026-08-26 Fixed in 1.2.13 CWE-79

TI-2026-27576 CVE-2026-35445 · GHSA-j5jq-cr68-v2xx

Winter: Authenticated backend users can bypass Users controller permission checks

LOW 32

Winter CMS is a content management system built on the Laravel PHP framework.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00439 Published 2026-08-26 Fixed in 1.2.13 CWE-285

TI-2026-55251 CVE-2026-79774 · GHSA-gw97-553p-fp3j

Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy

MEDIUM 44

Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sand…

CVSS 4.0CRITICAL 9.3 Network High privileges User interaction EPSS 0.00808 Published 2026-08-25 Fixed in 1.2.13 CWE-693

TI-2026-55250 CVE-2026-79773 · GHSA-gqr6-9g7c-7g7r

Winter CMS before 1.2.13 Local File Inclusion via JavaScript

LOW 31

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by pla…

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00493 Published 2026-08-25 Fixed in 1.2.13 CWE-22

TI-2026-21979 CVE-2026-27591 · GHSA-pgpf-m8m4-6cg6

Winter: Privilege escalation by authenticated backend users

MEDIUM 44

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00777 Published 2026-03-11 Fixed in 1.2.12, 1.1.12 +1 CWE-284

TI-2026-17864 CVE-2026-22254 · GHSA-m7gw-rffq-rxjm

Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager

LOW 17

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00286 Published 2026-02-06 Fixed in 1.2.10 CWE-79

TI-2024-36264 CVE-2024-54149 · GHSA-xhw3-4j3m-hq53

Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion

LOW 39

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.

CVSS 3.1HIGH 8.5 Network High privileges User interaction EPSS 0.0042 Published 2024-12-09 Fixed in 1.2.7, 1.1.11 +1 CWE-184

TI-2024-21102 CVE-2024-32003 · GHSA-chcp-g9j5-3xxx

Dusk plugin may allow unfettered user authentication in misconfigured installs

MEDIUM 41

wn-dusk-plugin (Dusk plugin) is a plugin which integrates Laravel Dusk browser testing into Winter CMS.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00672 Published 2024-04-12 Fixed in 2.1.0 CWE-269

TI-2024-19497 CVE-2024-29686 · GHSA-8r5j-gm3j-cx9c

Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote…

HIGH 67

Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01821 Published 2024-03-29 No fix listed CWE-97

TI-2023-28528 CVE-2023-52085 · GHSA-2x7r-93ww-cxrq

Winter CMS Local File Inclusion through Server Side Template Injection

MEDIUM 48

Winter is a free, open-source content management system.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.30166 Published 2023-12-29 Fixed in 1.2.4 CWE-22

TI-2023-28527 CVE-2023-52084 · GHSA-43w4-4j3c-jx29

Winter CMS Stored XSS through Backend ColorPicker FormWidget

LOW 24

Winter is a free, open-source content management system.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00309 Published 2023-12-28 Fixed in 1.2.4 CWE-79

TI-2023-28526 CVE-2023-52083 · GHSA-4wvw-75qh-fqjp

Stored XSS through privileged upload of Media Manager file followed by renaming

LOW 22

Winter is a free, open-source content management system.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00311 Published 2023-12-28 Fixed in 1.2.4 CWE-79

TI-2023-18899 CVE-2023-37269 · GHSA-wjw2-4j7j-6gc3

Winter CMS vulnerable to stored XSS through privileged upload of SVG file

LOW 27

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.027 Published 2023-07-07 Fixed in 1.2.3 CWE-79

TI-2022-18732 CVE-2022-39357 · GHSA-3fh5-q6fg-w28q

Winter vulnerable to Prototype Pollution in Snowboard framework

MEDIUM 46

Winter is a free, open-source content management system based on the Laravel PHP framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01366 Published 2022-10-26 Fixed in 1.1.10, 1.2.1 CWE-1321

Vulnerabilities

Filters