CVE-2026-79774: fallo crítico en wintercms winter
Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.3epss 0.8%
Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent models and query builders using methods like saveQuietly(), deleteQuietly(), increment(), decrement(), and newQuery() to read and modify arbitrary database records, execute arbitrary SQL, and achieve remote code execution by injecting PHP into template code sections.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Productos afectados
wintercms · winterCVEs relacionadas — wintercms winter
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-52085LOWWinter CMS Local File Inclusion through Server Side Template Injection EPSS 30.2%CVE-2023-37269LOWWinter CMS vulnerable to stored XSS through privileged upload of SVG fileEPSS 2.7%CVE-2022-39357HIGHWinter vulnerable to Prototype Pollution in Snowboard frameworkEPSS 1.4%CVE-2026-27591CRITICALWinter: Privilege escalation by authenticated backend usersEPSS 0.8%CVE-2026-63179MEDIUMWinter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assetsEPSS 0.5%CVE-2026-79773MEDIUMWinter CMS before 1.2.13 Local File Inclusion via JavaScriptEPSS 0.5%