CVE-2026-35445
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback _handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including protected, private, and action-prefixed ones. While AJAX requests validate that handler names match the on[A-Z][\w+]* pattern, the postback path passed the submitted _handler value straight to the handler dispatcher with no such check, so any controller that exposes a public action or conditionally relaxes its $requiredPermissions check could be reached, bypassing the roles and permissions system. The built-in Users controller was affected because it set $requiredPermissions to null for the myaccount action, letting any authenticated backend user invoke user-management methods such as update_onDelete and update_onManualPasswordReset without holding the backend.manage_users permission. This issue is fixed in version 1.2.13.
Risk Assessment
Risk of access control bypass and privilege escalation in the backend, potentially leading to unauthorized user management and system integrity violation.
Recommendation
Update Winter CMS to version 1.2.13 or later, which includes the fix for handler name validation in the postback path.
Other vulnerabilities in Winter CMS
See all- CVE-2026-63179Medium
Winter CMS up to version 1.2.12 contains a vulnerability that allows authenticated backend users to disclose arbitrary files readable by the PHP process by injecting @import directives into LESS source. The flaw is due to the LESS parser being instantiated without a safe import resolver. Fixed in version 1.2.13.
- CVE-2026-54256Medium
Winter CMS up to version 1.2.12 contains a vulnerability in the backend FileUpload form widget that trusts an attacker-controlled file_id POST parameter when resolving the attachment, allowing an authenticated backend user to read and modify attachment records belonging to other users or records. Fixed in version 1.2.13.
- CVE-2026-32639Medium
Winter CMS up to and including 1.2.12 did not enforce per-template-type permission checks in the Theme Editor, allowing a backend user with any single CMS permission to act on template types outside their scope. Additionally, the AssetList widget allowed unauthorized file uploads into the active theme's asset directory.
- CVE-2026-32593Medium
Winter CMS up to and including 1.2.12 is vulnerable to SQL injection in the backend Filter widget via the numberrange scope type when configured with a conditions key, allowing an authenticated backend user to inject arbitrary SQL. Exploitation requires a third-party plugin to have registered such a filter.
- CVE-2026-32258High
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manage_editor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on every backend page, allowing stored cross-site scripting. This issue is fixed in version 1.2.13.
- CVE-2026-32257High
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.manage_branding permission is compiled by the LESS parser and rendered without sanitization on every backend page, allowing stored cross-site scripting against backend users. This issue is fixed in version 1.2.13.
- CVE-2026-79774High
Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\Twig\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent models and query builders using methods like saveQuietly(), deleteQuietly(), increment(), decrement(), and newQuery() to read and modify arbitrary database records, execute arbitrary SQL, and achieve remote code execution by injecting PHP into template code sections.
- CVE-2026-79773Medium
Winter CMS before version 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can reference files like .env outside the theme directory, and the combined output served through the combine route becomes readable by unauthenticated visitors, exposing application keys and database credentials.
- CVE-2023-37269Low
In the Winter content management system, prior to version 1.2.3, users with the `backend.manage_branding` permission could upload SVG files as application logos without sanitization, potentially leading to XSS attacks. Version 1.2.3 introduces fixes that provide full support for SVG uploads and automatic sanitization of these files.
Original NVD description (English source)
Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback _handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including protected, private, and action-prefixed ones. While AJAX requests validate that handler names match the on[A-Z][\w+]* pattern, the postback path passed the submitted _handler value straight to the handler dispatcher with no such check, so any controller that exposes a public action or conditionally relaxes its $requiredPermissions check could be reached, bypassing the roles and permissions system. The built-in Users controller was affected because it set $requiredPermissions to null for the myaccount action, letting any authenticated backend user invoke user-management methods such as update_onDelete and update_onManualPasswordReset without holding the backend.manage_users permission. This issue is fixed in version 1.2.13.