← Vulnerability feed

Vulnerability record · CVE-2022-39357 · published 26 October 2022

CVE-2022-39357: Wintercms winter prototype pollution vulnerability

Wintercms · Winter

Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is vulnerable to prototype pollution in the main Snowboard class as well as its plugin loader. The 1.0 branch of Winter is not affected, as it does not contain the Snowboard framework. This issue has been patched in v1.1.10 and v1.2.1. As a workaround, one may avoid this issue by following some common security practices for JavaScript, including implementing a content security policy and auditing scripts.

9.8 CVSS 3.1 Critical EPSS 1.1% · top 35.3% CWE-1321 · Prototype pollution
9.8CVSS 3.1 base score
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References
17 Jun 2026Last modified by NVD

Description

Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2.0 is vulnerable to prototype pollution in the main Snowboard class as well as its plugin loader. The 1.0 branch of Winter is not affected, as it does not contain the Snowboard framework. This issue has been patched in v1.1.10 and v1.2.1. As a workaround, one may avoid this issue by following some common security practices for JavaScript, including implementing a content security policy and auditing scripts.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/wintercms/winter/commit/2a13faf99972e84c9661258f16c4750fa99d29a1 PatchThird Party Advisory
https://github.com/wintercms/winter/commit/bce4b59584abf961e9400af3d7a4fd7638e26c7f PatchThird Party Advisory
https://github.com/wintercms/winter/releases/tag/v1.1.10 Release NotesThird Party Advisory
https://github.com/wintercms/winter/releases/tag/v1.2.1 Release NotesThird Party Advisory
https://github.com/wintercms/winter/security/advisories/GHSA-3fh5-q6fg-w28q PatchThird Party Advisory
https://github.com/wintercms/winter/commit/2a13faf99972e84c9661258f16c4750fa99d29a1 PatchThird Party Advisory
https://github.com/wintercms/winter/commit/bce4b59584abf961e9400af3d7a4fd7638e26c7f PatchThird Party Advisory
https://github.com/wintercms/winter/releases/tag/v1.1.10 Release NotesThird Party Advisory
https://github.com/wintercms/winter/releases/tag/v1.2.1 Release NotesThird Party Advisory
https://github.com/wintercms/winter/security/advisories/GHSA-3fh5-q6fg-w28q PatchThird Party Advisory

Track CVE-2022-39357 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2026-27591Wintercms winter improper access control vulnerabilityWinter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.0.477, 1.1.12, and 1.2.12, Winter CMS al…EPSS 0.57%8.4CVE-2024-54149Wintercms winter vulnerabilityWinter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0…EPSS 0.42%7.2CVE-2024-29686Wintercms winter vulnerabilityServer-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to…EPSS 1.8%5.4CVE-2023-52085Wintercms winter path traversal vulnerabilityWinter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value…EPSS 30%5.4CVE-2023-52084Wintercms winter cross-site scripting vulnerabilityWinter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can…EPSS 0.31%4.8CVE-2023-52083Wintercms winter cross-site scripting vulnerabilityWinter is a free, open-source content management system. Prior to 1.2.4, users with the `media.manage_media` permission can upload files to the Media…EPSS 0.31%4.8CVE-2023-37269Wintercms winter cross-site scripting vulnerabilityWinter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission…EPSS 2.7%3.5CVE-2026-22254Wintercms winter cross-site scripting vulnerabilityWinter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users wi…EPSS 0.27%

Source: NIST National Vulnerability Database (record CVE-2022-39357), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.