What is the CVSS score of CVE-2026-32257?

CVE-2026-32257 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Winter CMS are affected by CVE-2026-32257?

Winter CMS backend contains a stored cross-site scripting vulnerability that allows users with branding or editor permissions to inject malicious code affecting all backend staff.. A patch is available.

How to fix or mitigate CVE-2026-32257?

Within 24 hours, inventory all Winter CMS deployments and audit backend access logs for suspicious edits to styling or markup settings; immediately restrict backend.manage_branding and backend.manage_editor permissions to essential personnel only. Within 7 days, apply the vendor-released patch to all affected Winter CMS instances and test backend page rendering to confirm malicious HTML injection is no longer possible. Within 30 days, conduct security audit of backend user accounts for unauthorized session activity, configuration changes, or actions that may indicate accounts were compromised.

Winter CMS CVE-2026-32257

EUVD-2026-66632 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-12 https://github.com/wintercms/winter

GHSA-v7cf-8gh9-gxmj

XSS

8.1

CVSS 3.1 · Vendor: https://github.com/wintercms/winter

Severity by source

Vendor (https://github.com/wintercms/winter) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

PR:H reflects mandatory manage_branding privilege; UI:R requires victim admin to load a backend page; S:C and C:H/I:H capture full session compromise of other users.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/wintercms/winter).

CVSS VectorVendor: https://github.com/wintercms/winter

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 12, 2026 - 15:20 vuln.today

Analysis Generated

Aug 12, 2026 - 15:20 vuln.today

CVE Published

Aug 12, 2026 - 14:40 github-advisory

HIGH 8.1

DescriptionCVE.org

Impact

Users with the backend.manage_branding ("Customize the back-end") permission can provide custom CSS through Settings → Customize Backend → Styles that is compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was not sanitized, which could have allowed a stored XSS attack.

Although this is a valid security issue, it's important to note that its severity is relatively low. To exploit the vulnerability, an attacker would already need to have trusted access to the Winter CMS backend with a specific administrative permission. The Winter CMS maintainers recommend that the backend.manage_branding permission only be granted to trusted administrators and developers.

A related issue exists in the custom styles field at Settings → Editor Settings → Markup Styles (backend.manage_editor permission), which uses the same rendering mechanism and is addressed separately.

All users are advised to update to the latest version to ensure their systems remain secure.

Patches

This issue has been patched in v1.2.13.

Workarounds

Apply https://github.com/wintercms/winter/commit/d28f0b9474af79cfaa80eeb9d691f7a7c4469720 manually if unable to upgrade to v1.2.13.

Resources

CVE-2025-61676 (identical vulnerability in October CMS, patched in v3.7.13 and v4.0.12)

AnalysisAI

Stored XSS in Winter CMS backend allows a high-privileged user with the backend.manage_branding permission to inject malicious HTML/JavaScript via the LESS CSS compiler's output in Settings → Customize Backend → Styles, which is rendered unsanitized on every backend page. The same rendering flaw is present in the Editor Settings → Markup Styles panel (backend.manage_editor permission), addressed in the same patch. An attacker exploiting this could steal session tokens or perform actions as any other authenticated backend user who visits a backend page. No public exploit or KEV listing exists, but the issue is confirmed by the vendor and an identical CVE (CVE-2025-61676) affects the sister project October CMS.

Technical ContextAI

Winter CMS is a PHP-based CMS (composer package winter/wn-backend-module) that uses the LESS CSS preprocessor to compile user-supplied custom styles stored in BrandSetting and EditorSetting models. LESS supports an escape syntax (~"...") that allows raw string interpolation into compiled output. Because the compiled CSS string was returned directly from renderCss() without sanitization, a user could embed </style><script>alert(1)</script><style> via the LESS escape construct, breaking out of the CSS context into executable HTML. CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) is the root cause class. The fix, confirmed in commit d28f0b9, applies PHP's strip_tags() to the compiled CSS output in both BrandSetting::renderCss() and EditorSetting::renderCss().

RemediationAI

Upgrade to Winter CMS backend module v1.2.13, which is the vendor-confirmed patched release. If an immediate upgrade is not possible, manually apply commit d28f0b9474af79cfaa80eeb9d691f7a7c4469720, which adds strip_tags() to the renderCss() method in both modules/backend/models/BrandSetting.php and modules/backend/models/EditorSetting.php. As a compensating control, revoke the backend.manage_branding and backend.manage_editor permissions from any accounts that do not strictly require them - the vendor already recommends limiting these permissions to trusted developers only. Note that strip_tags() is a minimal mitigation and does not sanitize all possible XSS vectors in CSS; upgrading remains the definitive fix. Advisory: https://github.com/wintercms/winter/security/advisories/GHSA-v7cf-8gh9-gxmj.