CVE-2026-79774: Winter CMS Twig sandbox escape in SecurityPolicy

CVE-2026-79774 · Severity: high · CVSS 8.4 · Published 2026-08-25

Winter CMS is a content management system that allows administrators to edit template code. A flaw in the template sandbox (a security layer meant to restrict dangerous operations) allows authenticated editors to bypass restrictions and gain unauthorized database access, modify data, and execute arbitrary code on the server. This affects users with template-editing permissions.

Technologies: winter/wn-system-module (Packagist). Vendors: Packagist, Winter CMS.

Quick answers

Is CVE-2026-79774 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-79774 being exploited in the wild.
How severe is CVE-2026-79774?
High severity, with a CVSS score of 8.4, published 25 August 2026.
Which products and versions are affected?
winter/wn-system-module (Packagist) ECOSYSTEM:introduced=1.2.7,fixed=1.2.13; Winter CMS Winter 1.2.7 to 1.2.12.
Is there a fix for CVE-2026-79774?
Yes. winter/wn-system-module (Packagist): upgrade to 1.2.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79774 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-79774?
Check whether you run winter/wn-system-module (Packagist) or Winter CMS Winter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • winter/wn-system-module (Packagist): upgrade to 1.2.13 or later
    composer require winter/wn-system-module:^1.2.13

Technical details

This is an incomplete fix for CVE-2024-54149 affecting Winter CMS versions 1.2.7–1.2.12. The Twig sandbox escape vulnerability exists in System\Twig\SecurityPolicy due to a flawed method blocklist that does not account for Eloquent model __call forwarding to the query builder. An authenticated backend user with cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions can bypass sandbox restrictions via forwarded methods (saveQuietly(), deleteQuietly(), increment(), decrement(), newQuery()) and higher-order collection methods that accept callables. Exploitation requires an existing backend account with template-editing permissions; no network authentication is needed beyond that. An attacker can read/modify arbitrary database records, execute raw SQL, exfiltrate credentials, and inject PHP into page/layout/partial code sections for RCE. The fix (v1.2.13) reworks SecurityPolicy with a transitive forwarder chain blocklist, expanded per-class restrictions, connection lockdown, and SafeCollection/SafePaginator proxies to neutralize callable arguments.

Affected products

  • Winter CMS Winter 1.2.7 to 1.2.12

Identifiers

  • CVE-2026-79774
  • GHSA-8cfw-pcwh-v63w

Timeline

  • 2026-08-07: disclosed
  • 2026-07-25: patched: Patch commit 725bbcda merged
  • 2026-08-25: advisory: CVE-2026-79774 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.