Executive brief
Winter CMS, a platform used for building and managing websites, contains a security flaw in its administrative interface. Users with limited administrative permissions can bypass restrictions to perform actions they are not authorized for, such as deleting website layouts or uploading unauthorized files. This could lead to unauthorized website modifications or the exposure of sensitive configuration files.
Technical details
A broken access control vulnerability exists in Winter CMS versions 1.2.12 and earlier. The `Cms\Controllers\Index` component used broad OR-logic for initial access but failed to implement per-template-type permission checks in specific AJAX handlers like `onSave()`, `onDelete()`, and `onDeleteTemplates()`. Additionally, the `AssetList` widget's `onUpload()` handler lacked theme validation, and the widget itself was registered for users without the `cms.manage_assets` permission. An attacker with any single CMS-related permission can exploit these omissions to modify or delete templates (pages, partials, layouts) and upload files to the active theme's asset directory. The issue is resolved in version 1.2.13.
Affected products
- Winter CMS wn-cms-module <= 1.2.12
Timeline
- 2026-08-07: disclosed: Initial disclosure by maintainers
- 2026-08-12: advisory: GitHub Advisory published
- 2026-08-12: patched: Fixed in version 1.2.13