CVE-2026-79774 json
Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy
published 2026-08-20 2 mo ago modified 2026-10-08 31 d ago also GHSA-8cfw-pcwh-v63w , EUVD-2026-65532
- cvss
- 8.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 57%
- public exploits
- 0
- none known
Summary
Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent models and query builders using methods like saveQuietly(), deleteQuietly(), increment(), decrement(), and newQuery() to read and modify arbitrary database records, execute arbitrary SQL, and achieve remote code execution by injecting PHP into template code sections.
Patch / fix
- packagist winter/wn-system-module 1.2.13
- wintercms winter 1.2.13
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 mo ago
Exploit prediction
0.81% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| CNA | 3.1 | 8.4 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| GitHub | 3.1 | 8.4 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | winter/wn-system-module | >=1.2.7, <1.2.13 |
1.2.13 |
Affected products
- wintercms winter
Classification
- Weakness
-
- CWE-693 Protection Mechanism Failure
References
-
github.com
/wintercms/winter/commit/725bbcda232466f7f71381c271c6916573d576e6
patch, web
-
github.com
/wintercms/winter/security/advisories/GHSA-8cfw-pcwh-v63w
vendor-advisory, web
-
vulncheck.com
/advisories/winter-cms-before-twig-sandbox-escape-via-securitypolicy
third-party-advisory
-
github.com
/advisories/GHSA-xhw3-4j3m-hq53
advisory
-
github.com
/wintercms/winter
package
-
github.com
/wintercms/winter/releases/tag/v1.2.13
web
Sources
- CVE List CVE-2026-79774
- GitHub Advisory GHSA-8cfw-pcwh-v63w
- NVD CVE-2026-79774
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.