CVE-2026-22254

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: cms.manage_assets. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general. This vulnerability is fixed in 1.2.10.

CVSS

No CVSS.

References

Link	Resource
https://github.com/wintercms/winter/commit/8a7f74b004fcd19721764fc63af0cdb339d9fb65	Patch
https://github.com/wintercms/winter/releases/tag/v1.2.10	Product Release Notes
https://github.com/wintercms/winter/security/advisories/GHSA-m7gw-rffq-rxjm	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wintercms:winter:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-06 20:16

Updated : 2026-02-20 21:03

NVD link : CVE-2026-22254

Mitre link : CVE-2026-22254

CVE.ORG link : CVE-2026-22254

JSON object : View

Products Affected

wintercms

winter

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

{"id": "CVE-2026-22254", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 0.0, "attackVector": "NETWORK", "baseSeverity": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 0.0, "exploitabilityScore": 0.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 0.9}]}, "published": "2026-02-06T20:16:10.057", "references": [{"url": "https://github.com/wintercms/winter/commit/8a7f74b004fcd19721764fc63af0cdb339d9fb65", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/wintercms/winter/releases/tag/v1.2.10", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/wintercms/winter/security/advisories/GHSA-m7gw-rffq-rxjm", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-80"}]}], "descriptions": [{"lang": "en", "value": "Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: cms.manage_assets. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general. This vulnerability is fixed in 1.2.10."}, {"lang": "es", "value": "Winter es un sistema de gesti\u00f3n de contenido (CMS) gratuito y de c\u00f3digo abierto basado en el framework PHP Laravel. Las versiones de Winter CMS anteriores a la 1.2.10 permit\u00edan a los usuarios con acceso al Gestor de Activos del CMS subir SVGs sin sanitizaci\u00f3n autom\u00e1tica. Para explotar activamente este problema de seguridad, un atacante necesitar\u00eda acceso al Backend con una cuenta de usuario con el siguiente permiso: cms.manage_assets. Los mantenedores de Winter CMS recomiendan encarecidamente que el permiso cms.manage_assets solo se reserve a administradores y desarrolladores de confianza en general. Esta vulnerabilidad est\u00e1 corregida en la 1.2.10."}], "lastModified": "2026-02-20T21:03:13.973", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wintercms:winter:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "588A92F0-EBF4-4A9A-A0A3-8BD4F9FDA03F", "versionEndExcluding": "1.2.10"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}