Winter CMS CVE-2026-79773

Exploitation requires an active Winter CMS backend account with the cms.manage_assets permission ('Manage website assets - images, JavaScript files, CSS files'). By default this permission is assigned to the built-in Developer role. The attacker must be able to write to a theme JavaScript asset via this permission. No special network conditions or non-default configuration is required beyond holding this permission. Target files must have a file extension (pre-patch, extension-less targets had .js appended - a minor restriction). The limiting factor for initial exploitation is the PR:H authentication barrier, making this an insider-threat or post-compromise escalation scenario; however, once the malicious asset is saved, the credential disclosure is accessible to fully unauthenticated visitors via the public combine route with no further attacker action needed.

The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N) accurately captures the two-phase risk profile: exploitation is gated by PR:H (cms.manage_assets), substantially limiting attacker population, but the resulting disclosure of APP_KEY and database credentials via an unauthenticated public route represents a high-severity confidentiality impact. No EPSS data was provided in the input, so exploitation probability cannot be quantified. KEV status is negative (not listed by CISA), and no public exploit code has been identified. Despite low CVSS complexity (AC:L, AT:N), real-world risk is bounded by the requirement for a compromised or malicious insider account with the specific cms.manage_assets permission. However, the cascading impact is severe: APP_KEY exposure enables Laravel deserialization attacks on many Winter CMS deployments, and database credential exposure enables direct data access. The Winter CMS maintainers explicitly flag that this permission should be restricted to trusted admins - environments where developer or contractor accounts hold this permission face materially higher risk. No signals conflict in the available data.

An attacker with a compromised or malicious Winter CMS backend account bearing cms.manage_assets opens a theme JavaScript asset in the backend editor and inserts a comment block containing =include ../../../.env. On the next page load referencing that asset, the combiner inlines the .env file contents into the compiled JavaScript, which is then served at a stable, publicly-accessible /combine/{file} URL. The attacker - or any unauthenticated visitor who discovers the URL - can retrieve the APP_KEY and database credentials directly from the JavaScript response.