Executive brief
Winter CMS is a content management system that allows administrators to customize styling through a backend interface. Authenticated users with developer or admin permissions can inject malicious code into stylesheet fields that causes the system to read arbitrary files from the server, including configuration files containing database credentials and encryption keys. An attacker with backend access could extract sensitive application secrets needed to compromise the entire system.
Technical details
This is a local file inclusion (LFI) vulnerability in Winter CMS's LESS stylesheet compilation pipeline. The root cause lies in the Less_Parser integration within Winter Storm, which was instantiated without a safe import resolver, allowing Less_FileManager::getFilePath() to fall back to raw attacker-supplied paths. Authenticated backend users with permissions for Brand Settings (backend.manage_branding), Editor Settings (backend.manage_editor), Mail Brand Settings (system.manage_mail_templates), or Theme assets (cms.manage_assets) can inject @import (inline) directives to reference arbitrary file paths. The vulnerability supports both absolute paths and path traversal (../) attacks. Exploitation requires backend authentication, but these permissions are assigned by default to the Developer role. The fix implements a LessImportResolver using callable form of Less_Parser::SetImportDirs() to restrict imports to allowed directory roots. Patches are available in Winter v1.2.13 and Winter Storm v1.2.13.
Affected products
- Winter CMS Winter CMS Backend Module <= 1.2.12
Timeline
- 2026-08-20: disclosed
- 2026-08-20: patched: Fixed in Winter v1.2.13 and Winter Storm v1.2.13