CVE-2026-22254 json
Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager
published 2026-02-04 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-5618 , GHSA-m7gw-rffq-rxjm
- cvss
- 0.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 21%
- public exploits
- 0
- none known
Summary
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: cms.manage_assets. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general. This vulnerability is fixed in 1.2.10.
Patch / fix
- packagist winter/wn-cms-module 1.2.10
- wintercms winter 1.2.10
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 0.0 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:N |
| GitHub | 3.1 | 0.0 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:N |
| NVD | 3.1 | 3.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | winter/wn-cms-module | <1.2.10 |
1.2.10 |
Affected products
- wintercms winter
Classification
References
-
github.com
/wintercms/winter/commit/8a7f74b004fcd19721764fc63af0cdb339d9fb65
web, patch
-
github.com
/wintercms/winter/security/advisories/GHSA-m7gw-rffq-rxjm
web, patch, vendor-advisory
-
github.com
/wintercms/winter/releases/tag/v1.2.10
web, product, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-22254
advisory
-
github.com
/wintercms/winter
package
Sources
- CVE List CVE-2026-22254
- GitHub Advisory GHSA-m7gw-rffq-rxjm
- NVD CVE-2026-22254
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.