Winter: CSRF through AJAX handler names reachable as backend page actions

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

6.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Impact Affected versions of Winter CMS allow a backend AJAX handler to be invoked by a plain top-level GET navigation with no CSRF token. Backend\Classes\Controller::actionExists() accepted any public method on a controller as a page action, so handler-shaped names were never reserved from URL dispatch: an authenticated and authorized request to /backend/system/eventlogs/indexonEmptyLog reached the handler of the same name and truncated the system event log. Backend paths are routed through Route::any, and CSRF validation is skipped for HEAD, GET and OPTIONS requests. The default SameSite=Lax session cookie is sent on top-level cross-site navigation, so a link on an attacker-controlled page is sufficient — no form, no script and no token. Handler arguments are taken from URL path segments, so the attacker also chooses the target record. Affected handlers across the backend, cms and system modules cover log truncation, resetting settings to their defaults, altering backend user state,…

Published by the source

20 Aug 2026, 18:44 UTC

Last modified by the source

20 Aug 2026, 19:00 UTC

Source last checked

26 Oct 2026, 14:50 UTC

1. Revision 2 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-p2ch-c2c3-4xm5

2. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-p2ch-c2c3-4xm5

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-p2ch-c2c3-4xm5

Advisory: Winter: CSRF through AJAX handler names reachable as backend page actions
IDs: GHSA-p2ch-c2c3-4xm5
Record: https://patchnext.com/advisories/ghsa-p2ch-c2c3-4xm5 (revision 2, source checked 26 Oct 2026, 14:50 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 6.1)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: winter/wn-backend-module 1.2.14. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist winter/wn-backend-module: affected >= 1.0.319, < 1.2.14; fixed in 1.2.14

## Suggested inspection (read-only)
- Packagist winter/wn-backend-module: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on winter/wn-backend-module.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-p2ch-c2c3-4xm5 (OSV record GHSA-p2ch-c2c3-4xm5 lists affected ranges: Packagist winter/wn-backend-module >=1.0.319 <1.2.14 (fixed))
- Verified: https://github.com/advisories/GHSA-p2ch-c2c3-4xm5 (GitHub-reviewed advisory GHSA-p2ch-c2c3-4xm5 lists affected ranges: Packagist winter/wn-backend-module >=1.0.319 <1.2.14)

Commands are suggestions: review each one before running it.