Every CVE Search/ Get API key

CVE-2023-52085

Winter CMS Local File Inclusion through Server Side Template Injection

3.3 LowFix available

Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

30.2%Up 30.1 points since Dec 29, 2023
90%50%10%1%

What each source reports

CVE List Score used 3.3

Winter CMS Local File Inclusion through Server Side Template Injection

Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.

Record
CVE-2023-52085
CVSS 3.1
3.3 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2024-0225 3.3

Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.

Record
EUVD-2024-0225
CVSS 3.1
3.3 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-2x7r-93ww-cxrq 3.3

Winter CMS Local File Inclusion through Server Side Template Injection

Impact

Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability.

By default, only the Brand Settings (backend.manage_branding) and Mail Brand Settings (system.manage_mail_templates) forms both include the colorpicker formwidget and pass the provided value to be compiled in LESS, however it is also common for themes to include it on their Theme Customization (cms.manage_theme_options) form and it is technically possible for the values on that form to also be used in LESS compilation: https://wintercms.com/docs/v1.2/docs/themes/development#asset-compiler-variables.

Patches

This issue has been patched in v1.2.4.

Workarounds

Apply https://github.com/wintercms/winter/commit/5bc9257fe2bc47d8b786a1b1bf96bafad23d8ddd manually if unable to upgrade to v1.2.4.

Record
GHSA-2x7r-93ww-cxrq
CVSS 3.1
3.3 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-22
Updated
2026-11-02
NVD 3.3

Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.

Record
CVE-2023-52085
CVSS 3.1
3.3 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-22
Updated
2026-11-02
OSV 3.3

Winter CMS Local File Inclusion through Server Side Template Injection

Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.

Record
CVE-2023-52085
CVSS 3.1
3.3 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVGHSA-2x7r-93ww-cxrq 3.3

Winter CMS Local File Inclusion through Server Side Template Injection

Impact

Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability.

By default, only the Brand Settings (backend.manage_branding) and Mail Brand Settings (system.manage_mail_templates) forms both include the colorpicker formwidget and pass the provided value to be compiled in LESS, however it is also common for themes to include it on their Theme Customization (cms.manage_theme_options) form and it is technically possible for the values on that form to also be used in LESS compilation: https://wintercms.com/docs/v1.2/docs/themes/development#asset-compiler-variables.

Patches

This issue has been patched in v1.2.4.

Workarounds

Apply https://github.com/wintercms/winter/commit/5bc9257fe2bc47d8b786a1b1bf96bafad23d8ddd manually if unable to upgrade to v1.2.4.

Record
GHSA-2x7r-93ww-cxrq
CVSS 3.1
3.3 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-22
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
winter/wn-backend-module
Packagist
 before 1.2.4
1.2.4
winter/wn-backend-module
Packagist
 before 1.2.4, plus listed versions
v1.0.473v1.0.474v1.0.475v1.1.10v1.1.11
Show 12 moreShow less
v1.1.2v1.1.3v1.1.4v1.1.5v1.1.6v1.1.7v1.1.8v1.1.9v1.2.0v1.2.1v1.2.2v1.2.3
1.2.4

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
NucleiWinter CMS Local File Inclusion - (LFI)

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, Nuclei, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-52085 is a low vulnerability (CVSS 3.3) in Wintercms Winter, published December 29, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 30.2%, the 98th percentile. Fixed in winter/wn-backend-module 1.2.4.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open