Executive brief
Winter CMS is a content management system that allows authorized administrators to manage website assets (images, JavaScript, CSS files). A vulnerability in how the system processes JavaScript asset includes allows a malicious administrator to embed directives that read arbitrary files from the server's filesystem—such as configuration files containing database credentials and encryption keys. Once the tampered asset is published, any visitor to the website can access these sensitive files through a public URL, potentially compromising the entire application and database.
Technical details
The vulnerability exists in Winter\Storm\Parse\Assetic\Filter\JavascriptImporter, which processes `=include` and `=require` directives in JavaScript comment blocks during asset compilation. An authenticated user with the `cms.manage_assets` permission can craft a directive like `=include ../../../.env` that uses path traversal to reference files outside the theme's asset directory. The vulnerable code resolves the target path using `realpath()` without confinement checks, retrieves the file content, and inlines it into combined output. Because the `combine/{file}` route serves this output without authentication, unauthenticated attackers can read the leaked contents at a stable URL. The attack is limited by file extension requirements (non-JS files can still be read if they have an extension), but the most critical exposure is the `.env` file. By default, the `cms.manage_assets` permission is assigned to the Developer role. The fix in v1.2.13 restricts includes to `.js` files and enforces path confinement using allowlisted import roots (themes, plugins, and modules directories).
Affected products
- Winter CMS winter/wn-system-module < 1.2.13
Timeline
- 2026-08-20: disclosed
- 2026-08-20: patched: Fixed in v1.2.13 (Winter core and Winter Storm)