CVE-2026-125341: fallo de gravedad baja en wintercms winter
Winter CMS: Stored XSS through Backend List widget image columns
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
5Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 2
Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\Widgets\Lists::evalImageTypeValue() interpolates the result of ImageResizer::filterGetUrl() into a single-quoted image source attribute without escaping it. In a third-party plugin that renders an attacker-influenced value through an image list column, an unsupported image value is returned verbatim, can break out of the attribute, and can inject event handlers that execute when a backend user views the list. Winter core ships no image list column, so a default installation is unaffected. This issue is fixed in version 1.2.14.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
Productos afectados
wintercms · winterCVEs relacionadas — wintercms winter
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-52085LOWWinter CMS Local File Inclusion through Server Side Template Injection EPSS 30.2%CVE-2023-37269LOWWinter CMS vulnerable to stored XSS through privileged upload of SVG fileEPSS 2.7%CVE-2022-39357HIGHWinter vulnerable to Prototype Pollution in Snowboard frameworkEPSS 1.4%CVE-2026-79774CRITICALWinter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicyEPSS 0.8%CVE-2026-27591CRITICALWinter: Privilege escalation by authenticated backend usersEPSS 0.8%CVE-2026-63179MEDIUMWinter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assetsEPSS 0.5%