CVE-2026-22254

Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager

State: Published
Severity: 0.0 None
Published: Feb 6, 2026
Updated: Feb 9, 2026
Reserved: Jan 7, 2026

Description

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: cms.manage_assets. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general. This vulnerability is fixed in 1.2.10.

Scores

CVSS	Score	Vector	Source
3.1	0.0 None	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:N	GitHub_M

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Affected Products

Product	Versions
winterwintercms	< 1.2.10Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.