Executive brief
Winter CMS is a content management system that includes a file upload widget for managing attachments in the backend interface. An authenticated attacker with any level of backend access could modify attachment metadata (titles, descriptions, and ordering) belonging to other users or records by submitting specially crafted requests with different file IDs. This could deface or disrupt attachment organization across the entire system, potentially affecting operational workflows and data integrity.
Technical details
This is an Insecure Direct Object Reference (IDOR) vulnerability in the FileUpload form widget. The vulnerability exists in the `getFileRecord()`, `onLoadAttachmentConfig()`, `onSaveAttachmentConfig()`, `onRemoveAttachment()`, and `onSortAttachments()` methods, which resolve user-supplied `file_id` POST parameters directly against the global `System\Models\File` model without verifying that the file belongs to the widget's relation, parent record, or deferred-binding session. Because attachment IDs are sequential integers, an attacker can enumerate and target arbitrary files. The fix (v1.2.13) scopes all lookups through `getRelationObject()->withDeferred($this->sessionKey)->find()` to restrict access to only files belonging to the current relation. Authentication is required (CSRF tokens are verified), but no special backend permissions are needed since the built-in avatar upload field is accessible to all authenticated users.
Affected products
- Winter CMS winter/wn-backend-module <= 1.2.12
Timeline
- 2026-08-20: disclosed: GitHub advisory published
- 2026-08-07: patched: Fix released in v1.2.13 (commit 9cb0ae5f9d837db141ab111c6a7de8eed9603d25)