EUVD-2026-66640
GHSA-m7jc-g4rc-jmvh
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Network AJAX endpoint requires backend authentication (PR:L); AC:H reflects the mandatory non-default plugin configuration prerequisite for the vulnerable scope.
Primary rating from Vendor (https://github.com/wintercms/winter).
CVSS VectorVendor: https://github.com/wintercms/winter
Lifecycle Timeline
2DescriptionCVE.org
Impact
The Backend Filter widget (Backend\Widgets\Filter) is vulnerable to SQL injection through the numberrange scope type when the scope is configured with a conditions key. An authenticated backend user with access to a list view containing a vulnerable filter scope can inject arbitrary SQL via the filter's AJAX handler, potentially gaining read access to the full database contents.
To exploit this, an attacker must have a valid backend account with access to a list view where a third-party plugin has registered a numberrange filter scope using the conditions configuration key. No built-in Winter CMS backend views use this scope type and configuration combination, so a vanilla installation without plugins is not exploitable.
Patches
This issue has been fixed in Winter CMS v1.2.13.
Workarounds
If users cannot upgrade, they may apply commit https://github.com/wintercms/winter/commit/50713de95adf5298536d93f4d999652525d36d43 to your Winter CMS installation manually to resolve this issue.
AnalysisAI
SQL injection in Winter CMS Backend Filter widget (versions <= 1.2.12) allows authenticated backend users to read arbitrary database contents by submitting crafted AJAX requests to the numberrange filter scope handler. Exploitation requires a third-party plugin to have registered a numberrange filter scope with the conditions configuration key - no built-in Winter CMS views use this combination, making vanilla installations unexploitable. The fix is confirmed in v1.2.13 via GitHub Advisory GHSA-m7jc-g4rc-jmvh; no public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
Winter CMS is a PHP/Laravel-based content management system. The vulnerable component is the Backend\Widgets\Filter class (Composer package winter/wn-backend-module). The numbersFromAjax() method - invoked by the filter's AJAX handler - failed to type-coerce or validate numeric range inputs before interpolating them into raw SQL conditions strings that accept :min and :max placeholders. This is a classic CWE-89 (Improper Neutralization of Special Elements in SQL Commands) failure: user-controlled string values were passed directly into SQL without parameterization or strict numeric validation. The commit diff confirms the fix adds strict numeric casting and rejects non-numeric input such as '9999 OR 1=1--', replacing unsafe string interpolation with parameterized bindings.
RemediationAI
Upgrade Winter CMS to v1.2.13, which is the vendor-confirmed patched release per GitHub Advisory GHSA-m7jc-g4rc-jmvh. For installations unable to upgrade immediately, apply the upstream fix manually from commit https://github.com/wintercms/winter/commit/50713de95adf5298536d93f4d999652525d36d43, which adds strict numeric validation to numbersFromAjax(). As a compensating control, audit installed third-party plugins and disable or remove any that register a numberrange filter scope using the conditions configuration key - this eliminates the vulnerable code path entirely without requiring a framework upgrade. Additionally, restricting backend access to the minimum necessary set of trusted users reduces the attack surface, since exploitation requires a valid backend account.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today