Executive brief
Winter CMS is a web content management system used to build and manage websites. Due to improper CSRF protection and request routing, an attacker can trick a logged-in administrator into visiting a malicious link that performs damaging actions without authorization, such as truncating logs, deleting templates, or resetting settings. This requires the victim to have developer-level permissions and to click a link, but no technical sophistication on the victim's part is needed.
Technical details
Winter CMS's backend routing failed to restrict AJAX handler-shaped method names from being invoked via GET requests. The vulnerability exists in the `Backend\Classes\Controller::actionExists()` method, which accepted any public controller method as a page action without validating the naming convention. Backend routes are processed through `Route::any()` and CSRF token validation is skipped for HEAD, GET, and OPTIONS requests. Attackers exploited this by crafting URLs like `/backend/system/eventlogs/index_onEmptyLog` that invoke handlers through top-level navigation. The default `SameSite=Lax` session cookie is automatically included on cross-site top-level navigation, allowing a simple link on an attacker-controlled page to execute state-changing operations (log deletion, template deletion, user state alteration, settings reset) without requiring a form submission or JavaScript. The fix restricts page-action dispatch to lowercase method names, reserving all handler-shaped names from URL reachability while preserving normal AJAX handler POST dispatch via the `X-WINTER-REQUEST-HANDLER` header. The patch was released in v1.2.14.
Affected products
- Winter CMS wn-backend-module >= 1.0.319, < 1.2.14
Timeline
- 2026-08-20: disclosed: Published to GitHub Advisory Database
- 2026-08-20: patched: Fixed in v1.2.14