← Vulnerability feed

Vulnerability record · CVE-2024-29686 · published 29 March 2024

CVE-2024-29686: Wintercms winter vulnerability

Wintercms · Winter

Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components. NOTE: the vendor disputes this because the payload could only be entered by a trusted user, such as the owner of the server that hosts Winter CMS, or a developer working for them.

7.2 CVSS 3.1 High EPSS 1.8% · top 22.1% CWE-97 · CWE-97
7.2CVSS 3.1 base score
1.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components. NOTE: the vendor disputes this because the payload could only be entered by a trusted user, such as the owner of the server that hosts Winter CMS, or a developer working for them.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://forum.ksec.co.uk/t/webapps-winter-cms-1-2-3-server-side-template-injection-ssti-authenticated/2779 Third Party Advisory
https://wintercms.com/docs/v1.2/docs/cms/themes#template-structure Product
https://www.exploit-db.com/exploits/51893 ExploitThird Party Advisory
https://forum.ksec.co.uk/t/webapps-winter-cms-1-2-3-server-side-template-injection-ssti-authenticated/2779 Third Party Advisory
https://wintercms.com/docs/v1.2/docs/cms/themes#template-structure Product
https://www.exploit-db.com/exploits/51893 ExploitThird Party Advisory

Track CVE-2024-29686 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2026-27591Wintercms winter improper access control vulnerabilityWinter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.0.477, 1.1.12, and 1.2.12, Winter CMS al…EPSS 0.77%9.8CVE-2022-39357Wintercms winter prototype pollution vulnerabilityWinter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2…EPSS 1.1%8.4CVE-2024-54149Wintercms winter vulnerabilityWinter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0…EPSS 0.42%5.4CVE-2023-52085Wintercms winter path traversal vulnerabilityWinter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value…EPSS 30%5.4CVE-2023-52084Wintercms winter cross-site scripting vulnerabilityWinter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can…EPSS 0.31%4.8CVE-2023-52083Wintercms winter cross-site scripting vulnerabilityWinter is a free, open-source content management system. Prior to 1.2.4, users with the `media.manage_media` permission can upload files to the Media…EPSS 0.31%4.8CVE-2023-37269Wintercms winter cross-site scripting vulnerabilityWinter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission…EPSS 2.7%3.5CVE-2026-22254Wintercms winter cross-site scripting vulnerabilityWinter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users wi…EPSS 0.27%

Source: NIST National Vulnerability Database (record CVE-2024-29686), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.