← Vulnerability feed

Vulnerability record · CVE-2026-22254 · published 6 February 2026

CVE-2026-22254: Wintercms winter cross-site scripting vulnerability

Wintercms · Winter

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: cms.manage_assets. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general. This vulnerability is fixed in 1.2.10.

3.5 CVSS 3.1 Low EPSS 0.27% · top 83.1% CWE-79 · Cross-site scriptingCWE-80 · CWE-80
3.5CVSS 3.1 base score
0.27%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: cms.manage_assets. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general. This vulnerability is fixed in 1.2.10.

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/wintercms/winter/commit/8a7f74b004fcd19721764fc63af0cdb339d9fb65 Patch
https://github.com/wintercms/winter/releases/tag/v1.2.10 ProductRelease Notes
https://github.com/wintercms/winter/security/advisories/GHSA-m7gw-rffq-rxjm PatchVendor Advisory

Track CVE-2026-22254 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2026-27591Wintercms winter improper access control vulnerabilityWinter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.0.477, 1.1.12, and 1.2.12, Winter CMS al…EPSS 0.77%9.8CVE-2022-39357Wintercms winter prototype pollution vulnerabilityWinter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard framework in versions 1.1.8, 1.1.9, and 1.2…EPSS 1.1%8.4CVE-2024-54149Wintercms winter vulnerabilityWinter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0…EPSS 0.42%7.2CVE-2024-29686Wintercms winter vulnerabilityServer-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to…EPSS 1.8%5.4CVE-2023-52085Wintercms winter path traversal vulnerabilityWinter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value…EPSS 30%5.4CVE-2023-52084Wintercms winter cross-site scripting vulnerabilityWinter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can…EPSS 0.31%4.8CVE-2023-52083Wintercms winter cross-site scripting vulnerabilityWinter is a free, open-source content management system. Prior to 1.2.4, users with the `media.manage_media` permission can upload files to the Media…EPSS 0.31%4.8CVE-2023-37269Wintercms winter cross-site scripting vulnerabilityWinter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission…EPSS 2.7%

Source: NIST National Vulnerability Database (record CVE-2026-22254), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.