Wintercms Winter vulnerabilities

• wintercms winter Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy CVE-2026-79774 Fix available 9.3 CriticalAugust 20, 2026
• wintercms winter Winter CMS before 1.2.13 Local File Inclusion via JavaScript CVE-2026-79773 Fix available 6.9 MediumAugust 20, 2026
• wintercms winter Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets CVE-2026-63179 Fix available 4.9 MediumAugust 20, 2026
• wintercms winter Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata CVE-2026-54256 Fix available 5.4 MediumAugust 20, 2026
• wintercms winter Winter: Authenticated backend users can bypass Users controller permission checks CVE-2026-35445 Fix available 7.1 HighAugust 12, 2026
• wintercms winter Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads CVE-2026-32639 Fix available 6.8 MediumAugust 12, 2026
• wintercms winter Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax CVE-2026-32593 Fix available 5.9 MediumAugust 12, 2026
• wintercms winter Winter: Stored XSS through Editor Settings custom styles CVE-2026-32258 Fix available 8.1 HighAugust 12, 2026
• wintercms winter Winter: Stored XSS through Brand Settings custom styles CVE-2026-32257 Fix available 8.1 HighAugust 12, 2026
• wintercms winter Winter: Privilege escalation by authenticated backend users CVE-2026-27591 Fix available 10.0 CriticalMarch 11, 2026
• wintercms winter Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager CVE-2026-22254 Fix available 0.0 NoneFebruary 4, 2026
• wintercms winter Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion CVE-2024-54149 Fix available 8.5 HighDecember 9, 2024
• wintercms winter Winter CMS Server-Side Template Injection (SSTI) vulnerability CVE-2024-29686 Disputed 7.2 HighMarch 29, 2024
• wintercms winter Winter CMS Local File Inclusion through Server Side Template Injection CVE-2023-52085 Fix available EPSS 30.2% 3.3 LowDecember 29, 2023
• wintercms winter Winter CMS Stored XSS through Backend ColorPicker FormWidget CVE-2023-52084 Fix available 2.0 LowDecember 28, 2023
• wintercms winter Stored XSS through privileged upload of Media Manager file followed by renaming CVE-2023-52083 Fix available 2.0 LowDecember 28, 2023
• wintercms winter Winter CMS vulnerable to stored XSS through privileged upload of SVG file CVE-2023-37269 Public exploitFix available 2.0 LowJuly 7, 2023
• wintercms winter Winter vulnerable to Prototype Pollution in Snowboard framework CVE-2022-39357 Fix available 8.1 HighOctober 26, 2022