Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Affected versions of Winter CMS did not enforce per-template-type permission checks in the CMS section's AJAX handlers. The CMS controller (Cms\Controllers\Index) used OR-logic across its five permissions (cms.managepages, cms.managepartials, cms.managelayouts, cms.managecontent, cms.manageassets) to control access to the section as a whole, but individual handlers such as onSave(), onDelete(), and onDeleteTemplates() did not verify that the authenticated user holds the specific permission corresponding to the requested template type. This allowed a backend user with any single Theme Editor permission (e.g. cms.managepages) to craft AJAX requests targeting template types outside their authorized scope — for example, deleting layouts, modifying partials, or reading content files. In addition, the AssetList widget was registered for all users who passed the controller gate regardless of whether they held the cms.manageassets permission, and its onUpload() handler was missing the…
Recommended action: Upgrade to 1.2.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Affected versions of Winter CMS allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: cms.manageassets The Winter CMS maintainers strongly recommend that the cms.manageassets permission only be reserved to trusted administrators and developers in general. Patches Sanitization of SVG assets is now applied automatically when uploading through the CMS Asset Manager. This security issue has been fixed as of https://github.com/wintercms/winter/commit/8a7f74b004fcd19721764fc63af0cdb339d9fb65. Workarounds If users cannot upgrade, they may apply commit https://github.com/wintercms/winter/commit/8a7f74b004fcd19721764fc63af0cdb339d9fb65 to their Winter CMS installation manually to resolve this issue.
Recommended action: Upgrade to 1.2.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Affected versions of Winter CMS allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on Twig files and modify resources such as theme customisation values or modify, or remove, templates in the theme even if not provided direct access via the permissions. As all objects passed through to Twig are references to the live objects, it is also possible to also manipulate model data if models are passed directly to Twig, including changing attributes or even removing records entirely. In most cases, this is unwanted behavior and potentially dangerous. To actively exploit this security issue, an attacker would need access to the Backend with a user account with any of the following permissions: - cms.managelayouts - cms.managepages - cms.managepartials The Winter CMS maintainers strongly recommend that these permissions only be reserved to trusted administrators and developers in general. Patches In order to mitigate this issue, we…
Recommended action: Upgrade to 1.2.7, 1.1.11 or 1.0.476 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.