CVE-2026-63179: Winter CMS local file inclusion via LESS @import directives

CVE-2026-63179 · Severity: medium · CVSS 4.9 · Published 2026-08-26

Winter CMS is a content management system that allows administrators to customize styling through a backend interface. Authenticated users with developer or admin permissions can inject malicious code into stylesheet fields that causes the system to read arbitrary files from the server, including configuration files containing database credentials and encryption keys. An attacker with backend access could extract sensitive application secrets needed to compromise the entire system.

Technologies: winter/wn-backend-module (Packagist), Winter CMS. Vendors: Packagist, Winter CMS.

Quick answers

Is CVE-2026-63179 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63179 being exploited in the wild.
How severe is CVE-2026-63179?
Medium severity, with a CVSS score of 4.9, published 26 August 2026.
Which products and versions are affected?
winter/wn-backend-module (Packagist) <= 1.2.12, ECOSYSTEM:introduced=0,fixed=1.2.13; Winter CMS <= 1.2.12.
Is there a fix for CVE-2026-63179?
Yes. winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63179 attacked?
It is attacked over the network.
Am I affected by CVE-2026-63179?
Check whether you run winter/wn-backend-module (Packagist) or Winter CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • winter/wn-backend-module (Packagist): upgrade to 1.2.13 or later
    composer require winter/wn-backend-module:^1.2.13

Technical details

This is a local file inclusion (LFI) vulnerability in Winter CMS's LESS stylesheet compilation pipeline. The root cause lies in the Less_Parser integration within Winter Storm, which was instantiated without a safe import resolver, allowing Less_FileManager::getFilePath() to fall back to raw attacker-supplied paths. Authenticated backend users with permissions for Brand Settings (backend.manage_branding), Editor Settings (backend.manage_editor), Mail Brand Settings (system.manage_mail_templates), or Theme assets (cms.manage_assets) can inject @import (inline) directives to reference arbitrary file paths. The vulnerability supports both absolute paths and path traversal (../) attacks. Exploitation requires backend authentication, but these permissions are assigned by default to the Developer role. The fix implements a LessImportResolver using callable form of Less_Parser::SetImportDirs() to restrict imports to allowed directory roots. Patches are available in Winter v1.2.13 and Winter Storm v1.2.13.

Affected products

  • Winter CMS Winter CMS Backend Module <= 1.2.12

Identifiers

  • CVE-2026-63179
  • GHSA-58fp-mcx6-7qf9

Timeline

  • 2026-08-20: disclosed
  • 2026-08-20: patched: Fixed in Winter v1.2.13 and Winter Storm v1.2.13

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.