wintercms vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20234
3. 20242
4. 202611

Newest CVEs

• CVE-2026-63179

  Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets

  wintercms · winter

  Medium4.9
• CVE-2026-54256

  Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

  wintercms · winter

  Medium5.4
• CVE-2026-32639

  Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

  wintercms · winter

  Medium6.8
• CVE-2026-32593

  Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax

  wintercms · winter

  Medium5.9
• CVE-2026-32258

  Winter: Stored XSS through Editor Settings custom styles

  wintercms · winter

  High8.1
• CVE-2026-32257

  Winter: Stored XSS through Brand Settings custom styles

  wintercms · winter

  High8.1
• CVE-2026-35445

  Winter: Authenticated backend users can bypass Users controller permission checks

  wintercms · winter

  High7.1
• CVE-2026-79774

  Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy

  wintercms · winter

  Critical9.3
• CVE-2026-79773

  Winter CMS before 1.2.13 Local File Inclusion via JavaScript

  wintercms · winter

  Medium6.9
• CVE-2026-27591

  Winter: Privilege escalation by authenticated backend users

  wintercms · winter

  Critical10.0