CVE-2026-79773

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can reference files like .env outside the theme directory, and the combined output served through the combine route becomes readable by unauthenticated visitors, exposing application keys and database credentials.

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can reference files like .env outside the theme directory, and the combined output served through the combine route becomes readable by unauthenticated visitors, exposing application keys and database credentials.

Impact

Affected versions of Winter CMS allow authenticated backend users with the cms.manage_assets permission ("Manage website assets - images, JavaScript files, CSS files") to disclose arbitrary files readable by the PHP process by placing an =include / =require directive in a theme JavaScript asset.

Winter\Storm\Parse\Assetic\Filter\JavascriptImporter processes =include / =require directives found in comment blocks of JavaScript assets passed through System\Classes\CombineAssets. The directive target was resolved relative to the including file's own directory with realpath() and inlined into the combined output with no confinement check, so a directive such as =include ../../../.env escaped the theme's asset tree and inlined an arbitrary server-readable file. The only restriction was that the target had to have a file extension, since extension-less names had .js appended to them.

Because the combined output is served through the combine/{file} route, which performs no authentication or authorization checks, the disclosed contents then became readable by unauthenticated visitors at a stable URL as soon as the asset was referenced by any template.

The leaked content includes any file the web process can read, most importantly the application .env file (disclosing APP_KEY and database credentials). Text files were disclosed intact; binary content was mangled by the minification pipeline.

This is the JavaScript-importer counterpart of GHSA-58fp-mcx6-7qf9 (Local File Inclusion through LESS @import directives) and of CVE-2023-52085 / GHSA-2x7r-93ww-cxrq — the same vulnerability class reached through a different asset combiner filter.

To actively exploit this issue, an attacker would need an authenticated backend account with the cms.manage_assets permission. By default this permission is assigned to the built-in Developer role. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general, as it grants direct write access to files that are combined and served publicly.

Patches

JavascriptImporter in Winter Storm now applies two independent gates to every =include / =require target:

1. Only .js targets may be inlined. Any other extension is rejected before path resolution, which neutralises disclosure of non-JavaScript server files such as .env, .php, and .log. Extension-less includes are unaffected, as they are resolved to .js before this check, exactly as before.
2. The resolved path must lie within the including file's own directory subtree or one of the caller-configured allowed import roots, enforced through the new PathResolver::withinAny() helper. A rejected include emits a comment in place of the file contents (or throws, if the directive was =require).

The allowed-roots configuration is now shared between the JavaScript importer and the LESS compiler through a HasAllowedImportRoots trait, and System\Classes\CombineAssets configures both — along with the CSS @import filter, using the import validator added in assetic/framework v3.2.1 — with themes_path(), plugins_path(), and base_path('modules') as the allowed roots. This preserves the cross-tree imports that shipped themes and plugins legitimately use (e.g. a plugin asset importing a module asset) while confining everything else.

The backend permission descriptions for cms.manage_assets and cms.manage_content now also carry the same "should only be given to trusted users" warning that was already displayed for cms.manage_pages, cms.manage_layouts, and cms.manage_partials.

This security issue has been fixed in v1.2.13 (Winter core) and v1.2.13 (Winter Storm).

###…

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can reference files like .env outside the theme directory, and the combined output served through the combine route becomes readable by unauthenticated visitors, exposing application keys and database credentials.

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can reference files like .env outside the theme directory, and the combined output served through the combine route becomes readable by unauthenticated visitors, exposing application keys and database credentials.

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can reference files like .env outside the theme directory, and the combined output served through the combine route becomes readable by unauthenticated visitors, exposing application keys and database credentials.

Impact

Affected versions of Winter CMS allow authenticated backend users with the cms.manage_assets permission ("Manage website assets - images, JavaScript files, CSS files") to disclose arbitrary files readable by the PHP process by placing an =include / =require directive in a theme JavaScript asset.

Winter\Storm\Parse\Assetic\Filter\JavascriptImporter processes =include / =require directives found in comment blocks of JavaScript assets passed through System\Classes\CombineAssets. The directive target was resolved relative to the including file's own directory with realpath() and inlined into the combined output with no confinement check, so a directive such as =include ../../../.env escaped the theme's asset tree and inlined an arbitrary server-readable file. The only restriction was that the target had to have a file extension, since extension-less names had .js appended to them.

Because the combined output is served through the combine/{file} route, which performs no authentication or authorization checks, the disclosed contents then became readable by unauthenticated visitors at a stable URL as soon as the asset was referenced by any template.

The leaked content includes any file the web process can read, most importantly the application .env file (disclosing APP_KEY and database credentials). Text files were disclosed intact; binary content was mangled by the minification pipeline.

This is the JavaScript-importer counterpart of GHSA-58fp-mcx6-7qf9 (Local File Inclusion through LESS @import directives) and of CVE-2023-52085 / GHSA-2x7r-93ww-cxrq — the same vulnerability class reached through a different asset combiner filter.

To actively exploit this issue, an attacker would need an authenticated backend account with the cms.manage_assets permission. By default this permission is assigned to the built-in Developer role. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general, as it grants direct write access to files that are combined and served publicly.

Patches

JavascriptImporter in Winter Storm now applies two independent gates to every =include / =require target:

1. Only .js targets may be inlined. Any other extension is rejected before path resolution, which neutralises disclosure of non-JavaScript server files such as .env, .php, and .log. Extension-less includes are unaffected, as they are resolved to .js before this check, exactly as before.
2. The resolved path must lie within the including file's own directory subtree or one of the caller-configured allowed import roots, enforced through the new PathResolver::withinAny() helper. A rejected include emits a comment in place of the file contents (or throws, if the directive was =require).

The allowed-roots configuration is now shared between the JavaScript importer and the LESS compiler through a HasAllowedImportRoots trait, and System\Classes\CombineAssets configures both — along with the CSS @import filter, using the import validator added in assetic/framework v3.2.1 — with themes_path(), plugins_path(), and base_path('modules') as the allowed roots. This preserves the cross-tree imports that shipped themes and plugins legitimately use (e.g. a plugin asset importing a module asset) while confining everything else.

The backend permission descriptions for cms.manage_assets and cms.manage_content now also carry the same "should only be given to trusted users" warning that was already displayed for cms.manage_pages, cms.manage_layouts, and cms.manage_partials.

This security issue has been fixed in v1.2.13 (Winter core) and v1.2.13 (Winter Storm).

###…