Winter CMS CSRF through backend page action routing

Severity: medium · CVSS 6.1 · Published 2026-08-20

Winter CMS is a web content management system used to build and manage websites. Due to improper CSRF protection and request routing, an attacker can trick a logged-in administrator into visiting a malicious link that performs damaging actions without authorization, such as truncating logs, deleting templates, or resetting settings. This requires the victim to have developer-level permissions and to click a link, but no technical sophistication on the victim's part is needed.

Technologies: winter/wn-backend-module (Packagist), Winter CMS WN Backend Module. Vendors: Packagist, Winter CMS.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 6.1, published 20 August 2026.
Which products and versions are affected?
winter/wn-backend-module (Packagist) >= 1.0.319, < 1.2.14; Winter CMS WN Backend Module >= 1.0.319, < 1.2.14.
Is there a fix for This vulnerability?
A patch was published on 2026-08-20: Fixed in v1.2.14 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a web application.
Am I affected?
Check whether you run winter/wn-backend-module (Packagist) or Winter CMS WN Backend Module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Winter CMS's backend routing failed to restrict AJAX handler-shaped method names from being invoked via GET requests. The vulnerability exists in the `Backend\Classes\Controller::actionExists()` method, which accepted any public controller method as a page action without validating the naming convention. Backend routes are processed through `Route::any()` and CSRF token validation is skipped for HEAD, GET, and OPTIONS requests. Attackers exploited this by crafting URLs like `/backend/system/eventlogs/index_onEmptyLog` that invoke handlers through top-level navigation. The default `SameSite=Lax` session cookie is automatically included on cross-site top-level navigation, allowing a simple link on an attacker-controlled page to execute state-changing operations (log deletion, template deletion, user state alteration, settings reset) without requiring a form submission or JavaScript. The fix restricts page-action dispatch to lowercase method names, reserving all handler-shaped names from URL reachability while preserving normal AJAX handler POST dispatch via the `X-WINTER-REQUEST-HANDLER` header. The patch was released in v1.2.14.

Affected products

  • Winter CMS wn-backend-module >= 1.0.319, < 1.2.14

Timeline

  • 2026-08-20: disclosed: Published to GitHub Advisory Database
  • 2026-08-20: patched: Fixed in v1.2.14

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.