CVE-2026-32257: Winter CMS stored XSS in Brand Settings custom styles

Executive brief

Winter CMS, a platform used for building and managing websites, contains a vulnerability that allows administrative users to inject malicious scripts into the management interface. An attacker with specific branding permissions could use this to execute code in the browsers of other administrators, potentially leading to unauthorized data access or account takeover. This issue is resolved in version 1.2.13.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in Winter CMS within the 'Customize Backend' and 'Markup Styles' settings. The application uses a LESS CSS parser to compile user-provided styles but failed to sanitize the compiled output before rendering it on backend pages. An attacker with 'backend.manage_branding' or 'backend.manage_editor' permissions can inject malicious payloads that execute in the context of other backend users. The vulnerability is addressed in version 1.2.13 by implementing proper sanitization of the compiled CSS output.

Affected products

• Winter CMS Winter CMS <= 1.2.12

Timeline

• 2026-08-07: disclosed: Initial disclosure by maintainers
• 2026-08-12: advisory: GitHub Advisory published
• 2026-08-12: patched: Patch confirmed in version 1.2.13

References

• https://api.github.com/users/skyhex19
• https://github.com/skyhex19
• https://api.github.com/users/skyhex19/gists%7B/gist_id%7D
• https://api.github.com/users/skyhex19/repos
• https://avatars.githubusercontent.com/u/102454417?v=4
• https://api.github.com/users/skyhex19/events%7B/privacy%7D