# CVE-2026-125339: Winter CMS CSRF via unvalidated backend handler invocation

Source: https://junglewise.ai/threats/cve-2026-125339-winter-cms-is-a-content-management-system-built-on-the-laravel  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125339 · Severity: medium · CVSS 6.1 · Published 2026-11-10

Winter CMS is a content management system built on Laravel. The backend controller accepts GET requests to invoke state-changing AJAX handlers without CSRF token validation, allowing an attacker to trick an authenticated admin into visiting a malicious link that performs unauthorized actions like truncating logs, resetting settings, or deleting templates. An unauthenticated attacker can exploit this by inducing a logged-in backend user to click a link that modifies the system.

Technologies: [Winter CMS](https://junglewise.ai/threats/technologies/winter-cms). Vendors: [Winter CMS](https://junglewise.ai/threats/vendors/winter-cms).

## Quick answers

**Is CVE-2026-125339 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125339 being exploited in the wild.

**How severe is CVE-2026-125339?** Medium severity, with a CVSS score of 6.1, published 10 November 2026.

**Which products and versions are affected?** Winter CMS 1.0.319 to 1.2.13.

**Is there a fix for CVE-2026-125339?** Yes: fixed in 1.2.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125339 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-125339?** Check whether you run Winter CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.2.14

## Technical details

The vulnerability exists in Backend\Classes\Controller::actionExists(), which accepts public handler-shaped methods as page actions without case-sensitivity validation. Because backend routes use Route::any(), CSRF validation skips GET requests, and the default SameSite=Lax cookie is sent cross-site, an attacker can craft a URL like /backend/system/eventlogs/index_onEmptyLog to invoke index_onEmptyLog() without a CSRF token. The fix in v1.2.14 enforces lowercase-only action method names and normalizes dashed URLs to snake_case, blocking the case-insensitive bypass.

## Affected products

- Winter CMS Winter CMS 1.0.319 to 1.2.13

## Timeline

- 2026-11-10: disclosed
- 2026-08-19: patched: v1.2.14 released with security hardening

## References

- [https://github.com/wintercms/winter/commit/353b23804dee2acf49fca996c72637040446824f](https://github.com/wintercms/winter/commit/353b23804dee2acf49fca996c72637040446824f)
- [https://github.com/wintercms/winter/releases/tag/v1.2.14](https://github.com/wintercms/winter/releases/tag/v1.2.14)

## Related threats

- [Winter CMS MyAccount controller information disclosure](https://junglewise.ai/threats/cve-2026-126061-winter-cms-is-a-content-management-system-built-on-the-laravel)
- [Winter CMS reflected XSS in Table widget search parameter](https://junglewise.ai/threats/cve-2026-125340-winter-cms-is-a-content-management-system-built-on-the-laravel)
- [Winter CMS stored XSS in backend brand and editor settings](https://junglewise.ai/threats/cve-2026-125338-winter-cms-is-a-content-management-system-built-on-the-laravel)
- [Winter CMS local file inclusion via LESS @import directives](https://junglewise.ai/threats/cve-2026-63179-winter-cms-local-file-inclusion-via-less-import-directives)
- [Winter CMS broken access control in Cms Controllers Index](https://junglewise.ai/threats/cve-2026-32639-winter-cms-broken-access-control-in-cms-controllers-index)