Is CVE-2026-79773 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79773 being exploited in the wild.

How severe is CVE-2026-79773?

Medium severity, with a CVSS score of 4.9, published 25 August 2026.

Which products and versions are affected?

winter/wn-system-module (Packagist) ECOSYSTEM:introduced=0,fixed=1.2.13; Winter CMS before 1.2.13.

Is there a fix for CVE-2026-79773?

Yes. winter/wn-system-module (Packagist): upgrade to 1.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-79773 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-79773?

Check whether you run winter/wn-system-module (Packagist) or Winter CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79773: Winter CMS local file inclusion in JavascriptImporter filter

CVE-2026-79773 · Severity: medium · CVSS 4.9 · Published 2026-08-25

Winter CMS is a content management system that manages website themes and assets. Authenticated users with asset management permissions can inject directives into JavaScript files that cause the system to include arbitrary server files (like .env configuration files) in the output. This exposed data is then served to any visitor of the website, leaking sensitive credentials and application keys.

Technologies: winter/wn-system-module (Packagist), Winter CMS. Vendors: Packagist, Winter CMS.

Quick answers

Is CVE-2026-79773 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79773 being exploited in the wild.
How severe is CVE-2026-79773?: Medium severity, with a CVSS score of 4.9, published 25 August 2026.
Which products and versions are affected?: winter/wn-system-module (Packagist) ECOSYSTEM:introduced=0,fixed=1.2.13; Winter CMS before 1.2.13.
Is there a fix for CVE-2026-79773?: Yes. winter/wn-system-module (Packagist): upgrade to 1.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79773 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-79773?: Check whether you run winter/wn-system-module (Packagist) or Winter CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

winter/wn-system-module (Packagist): upgrade to 1.2.13 or later
```
composer require winter/wn-system-module:^1.2.13
```

Technical details

Winter CMS before version 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter component. The vulnerability exists because the filter does not properly validate or restrict file paths when processing =include or =require directives in JavaScript assets, allowing directory traversal attacks. Authenticated users with the cms.manage_assets permission can place malicious directives in theme JavaScript files to reference files outside the theme directory (such as .env). The combined asset output served through the combine route is accessible to unauthenticated visitors, exposing sensitive files containing database credentials and application keys. Fixes have been applied via commits to confine JavaScript importer paths to allowed directory roots.

Affected products

Winter CMS Winter CMS before 1.2.13

Identifiers

CVE-2026-79773
GHSA-2223-f22x-24cq

Timeline

2026-08-25: disclosed
2026-08-06: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.