CVE-2026-54256: Winter CMS FileUpload widget IDOR in attachment metadata

CVE-2026-54256 · Severity: medium · CVSS 5.4 · Published 2026-08-26

Winter CMS is a content management system that includes a file upload widget for managing attachments in the backend interface. An authenticated attacker with any level of backend access could modify attachment metadata (titles, descriptions, and ordering) belonging to other users or records by submitting specially crafted requests with different file IDs. This could deface or disrupt attachment organization across the entire system, potentially affecting operational workflows and data integrity.

Technologies: winter/wn-backend-module (Packagist), Winter CMS Backend Module. Vendors: Packagist, Winter CMS.

Quick answers

Is CVE-2026-54256 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54256 being exploited in the wild.
How severe is CVE-2026-54256?
Medium severity, with a CVSS score of 5.4, published 26 August 2026.
Which products and versions are affected?
winter/wn-backend-module (Packagist) <= 1.2.12, ECOSYSTEM:introduced=0,fixed=1.2.13; Winter CMS Backend Module <= 1.2.12.
Is there a fix for CVE-2026-54256?
Yes. winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54256 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54256?
Check whether you run winter/wn-backend-module (Packagist) or Winter CMS Backend Module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later
    composer require winter/wn-backend-module:^1.2.13

Technical details

This is an Insecure Direct Object Reference (IDOR) vulnerability in the FileUpload form widget. The vulnerability exists in the `getFileRecord()`, `onLoadAttachmentConfig()`, `onSaveAttachmentConfig()`, `onRemoveAttachment()`, and `onSortAttachments()` methods, which resolve user-supplied `file_id` POST parameters directly against the global `System\Models\File` model without verifying that the file belongs to the widget's relation, parent record, or deferred-binding session. Because attachment IDs are sequential integers, an attacker can enumerate and target arbitrary files. The fix (v1.2.13) scopes all lookups through `getRelationObject()->withDeferred($this->sessionKey)->find()` to restrict access to only files belonging to the current relation. Authentication is required (CSRF tokens are verified), but no special backend permissions are needed since the built-in avatar upload field is accessible to all authenticated users.

Affected products

  • Winter CMS winter/wn-backend-module <= 1.2.12

Identifiers

  • CVE-2026-54256
  • GHSA-3277-h8g9-qj5f

Timeline

  • 2026-08-20: disclosed: GitHub advisory published
  • 2026-08-07: patched: Fix released in v1.2.13 (commit 9cb0ae5f9d837db141ab111c6a7de8eed9603d25)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.