CVE-2026-79773
Winter CMS before 1.2.13 Local File Inclusion via JavaScript
- State
- Published
- Severity
- 6.9 Medium
- Published
- Aug 25, 2026
- Updated
- Oct 8, 2026
- Reserved
- Aug 25, 2026
Description
Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can reference files like .env outside the theme directory, and the combined output served through the combine route becomes readable by unauthenticated visitors, exposing application keys and database credentials.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.9 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
winterwintercms |
|
References
- GitHub Security Advisory (GHSA-2223-f22x-24cq)vendor-advisory
- Patch Commitpatch
- Patch Commitpatch
- VulnCheck Advisory: Winter CMS before 1.2.13 Local File Inclusion via JavaScriptthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.