Winter
CVE-2026-22254
NONE
GHSA-m7gw-rffq-rxjm
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Attack vector: Network. Complexity: Low. Privileges required: High. User interaction: Required. Exploitation requires authentication. |
| Exploit ScenarioDerived | An attacker (requires authentication) could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization.
RemediationAI
A vendor patch is available — apply it immediately. Fixed in version 1.2.10.. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Winter. Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: cms.manage_assets. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to
Know when Winter gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:N
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: cms.manage_assets. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general. This vulnerability is fixed in 1.2.10.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Affected Products (CPE)GitHub Advisory
Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary
Winter is a free, open-source content management system based on the Laravel PHP framework. Rated critical severity (CVS
Winter is a free, open-source content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotel
Authenticated Twig sandbox escape in Winter CMS before 1.2.13 lets backend users holding template-editing permissions (c
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Rated medium severity
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Rated high severity (C
Local file inclusion in Winter CMS before 1.2.13 allows authenticated backend users holding the cms.manage_assets permis
Winter is a free, open-source content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotel
Winter is a free, open-source content management system. Rated medium severity (CVSS 4.8), this vulnerability is remotel
Exploit-DB