# CVE-2026-32593: Winter CMS SQL injection in Backend Filter Widget numberrange scope

Source: https://junglewise.ai/threats/cve-2026-32593-winter-cms-sql-injection-in-backend-filter-widget-numberrange  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-08-12  
License: CC BY 4.0 with a link back

CVE-2026-32593 · Severity: medium · CVSS 5.9 · Published 2026-08-26

Winter CMS, a content management system, is vulnerable to a security flaw in its administrative interface. An authorized user with access to specific data filters could potentially execute unauthorized database commands. This could allow an attacker to view sensitive information stored in the database that they are not normally permitted to see. This issue primarily affects sites using third-party plugins that implement specific numeric range filters.

Technologies: [winter/wn-backend-module (Packagist)](https://junglewise.ai/threats/technologies/winter-wn-backend-module), [Winter CMS](https://junglewise.ai/threats/technologies/winter-cms). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Winter CMS](https://junglewise.ai/threats/vendors/winter-cms).

## Quick answers

**Is CVE-2026-32593 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32593 being exploited in the wild.

**How severe is CVE-2026-32593?** Medium severity, with a CVSS score of 5.9, published 26 August 2026.

**Which products and versions are affected?** winter/wn-backend-module (Packagist) <= 1.2.12, ECOSYSTEM:introduced=0,fixed=1.2.13; Winter CMS <= 1.2.12.

**Is there a fix for CVE-2026-32593?** Yes. winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32593 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-32593?** Check whether you run winter/wn-backend-module (Packagist) or Winter CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later

  ```sh
  composer require winter/wn-backend-module:^1.2.13
  ```


## Technical details

A SQL injection vulnerability exists in the Winter CMS Backend Filter widget (`Backend\Widgets\Filter`). The flaw is located in the `numberrange` scope type when it is configured using a `conditions` key, specifically within the `numbersFromAjax` handler. An authenticated attacker with access to a list view utilizing this specific filter configuration can inject arbitrary SQL commands. While vanilla installations do not use this specific configuration, third-party plugins may introduce the vulnerable scope. The issue has been patched in version 1.2.13 by improving input sanitization within the filter widget.

## Affected products

- Winter CMS Winter CMS <= 1.2.12

## Identifiers

- CVE-2026-32593
- GHSA-m7jc-g4rc-jmvh

## Timeline

- 2026-08-07: disclosed: Vulnerability reported to Winter CMS
- 2026-08-12: advisory: GitHub Advisory published
- 2026-08-12: patched: Fixed in Winter CMS v1.2.13

## References

- [https://api.github.com/users/M9nx](https://api.github.com/users/M9nx)
- [https://github.com/M9nx](https://github.com/M9nx)
- [https://api.github.com/users/M9nx/gists%7B/gist_id%7D](https://api.github.com/users/M9nx/gists%7B/gist_id%7D)
- [https://api.github.com/users/M9nx/repos](https://api.github.com/users/M9nx/repos)
- [https://avatars.githubusercontent.com/u/90654832?v=4](https://avatars.githubusercontent.com/u/90654832?v=4)
- [https://api.github.com/users/M9nx/events%7B/privacy%7D](https://api.github.com/users/M9nx/events%7B/privacy%7D)

## Related threats

- [Winter CMS MyAccount controller information disclosure](https://junglewise.ai/threats/cve-2026-126061-winter-cms-is-a-content-management-system-built-on-the-laravel)
- [Winter CMS reflected XSS in Table widget search parameter](https://junglewise.ai/threats/cve-2026-125340-winter-cms-is-a-content-management-system-built-on-the-laravel)
- [Winter CMS CSRF via unvalidated backend handler invocation](https://junglewise.ai/threats/cve-2026-125339-winter-cms-is-a-content-management-system-built-on-the-laravel)
- [Winter CMS stored XSS in backend brand and editor settings](https://junglewise.ai/threats/cve-2026-125338-winter-cms-is-a-content-management-system-built-on-the-laravel)
- [Winter CMS local file inclusion via LESS @import directives](https://junglewise.ai/threats/cve-2026-63179-winter-cms-local-file-inclusion-via-less-import-directives)