Skip to main content

Winter CMS CVE-2026-79773

| EUVDEUVD-2026-65531 MEDIUM
Path Traversal (CWE-22)
2026-08-25 VulnCheck GHSA-gqr6-9g7c-7g7r
Path Traversal Winter
6.9
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.9 MEDIUM

PR:H required for cms.manage_assets; S:U as both write and public read occur within the same Winter CMS instance; C:H for APP_KEY and credential disclosure; no integrity or availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 25, 2026 - 16:14 vuln.today
Analysis Generated
Aug 25, 2026 - 16:14 vuln.today

DescriptionCVE.org

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can reference files like .env outside the theme directory, and the combined output served through the combine route becomes readable by unauthenticated visitors, exposing application keys and database credentials.

AnalysisAI

Local file inclusion in Winter CMS before 1.2.13 allows authenticated backend users holding the cms.manage_assets permission to exfiltrate arbitrary server-readable files - including .env - by embedding =include or =require path-traversal directives in theme JavaScript assets. The critical escalation is that the resulting combined asset output is served unauthenticated via the public combine/{file} route, meaning a single privileged write operation exposes APP_KEY and database credentials to any unauthenticated visitor. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain backend account with cms.manage_assets
Delivery
Edit theme JS asset to embed =include ../../../.env directive
Exploit
Trigger asset compilation via page load
Execution
Retrieve disclosed .env contents from public /combine/{file} URL
Impact
Extract APP_KEY and database credentials
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an active Winter CMS backend account with the cms.manage_assets permission ('Manage website assets - images, JavaScript files, CSS files'). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N) accurately captures the two-phase risk profile: exploitation is gated by PR:H (cms.manage_assets), substantially limiting attacker population, but the resulting disclosure of APP_KEY and database credentials via an unauthenticated public route represents a high-severity confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a compromised or malicious Winter CMS backend account bearing cms.manage_assets opens a theme JavaScript asset in the backend editor and inserts a comment block containing =include ../../../.env. On the next page load referencing that asset, the combiner inlines the .env file contents into the compiled JavaScript, which is then served at a stable, publicly-accessible /combine/{file} URL. …
Remediation Upgrade to Winter CMS 1.2.13 or later - vendor-released patch confirmed. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Winter

View all
CVE-2024-29686 HIGH POC
7.2 Mar 29

Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary

CVE-2022-39357 CRITICAL
9.8 Oct 26

Winter is a free, open-source content management system based on the Laravel PHP framework. Rated critical severity (CVS
CVE-2023-52085 MEDIUM POC
5.4 Dec 29

Winter is a free, open-source content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotel
CVE-2026-79774 CRITICAL
9.3 Aug 25

Authenticated Twig sandbox escape in Winter CMS before 1.2.13 lets backend users holding template-editing permissions (c
CVE-2023-37269 MEDIUM POC
4.8 Jul 07

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Rated medium severity

CVE-2024-54149 HIGH POC
8.4 Dec 09

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Rated high severity (C
CVE-2023-52084 MEDIUM
5.4 Dec 28

Winter is a free, open-source content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotel
CVE-2023-52083 MEDIUM
4.8 Dec 28

Winter is a free, open-source content management system. Rated medium severity (CVSS 4.8), this vulnerability is remotel

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Share

CVE-2026-79773 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy