Executive brief
Winter CMS, a content management system, is vulnerable to a security flaw in its administrative interface. An authorized user with access to specific data filters could potentially execute unauthorized database commands. This could allow an attacker to view sensitive information stored in the database that they are not normally permitted to see. This issue primarily affects sites using third-party plugins that implement specific numeric range filters.
Technical details
A SQL injection vulnerability exists in the Winter CMS Backend Filter widget (`Backend\Widgets\Filter`). The flaw is located in the `numberrange` scope type when it is configured using a `conditions` key, specifically within the `numbersFromAjax` handler. An authenticated attacker with access to a list view utilizing this specific filter configuration can inject arbitrary SQL commands. While vanilla installations do not use this specific configuration, third-party plugins may introduce the vulnerable scope. The issue has been patched in version 1.2.13 by improving input sanitization within the filter widget.
Affected products
- Winter CMS Winter CMS <= 1.2.12
Timeline
- 2026-08-07: disclosed: Vulnerability reported to Winter CMS
- 2026-08-12: advisory: GitHub Advisory published
- 2026-08-12: patched: Fixed in Winter CMS v1.2.13