CSRF in Wintercms Winter
CVE-2026-125339
Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\Classes\Controller::actionExists() accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing backend AJAX handlers without a CSRF token. Because backend routes use Route::any, CSRF validation skips GET, and the default SameSite=Lax session cookie is sent on cross-site navigation, an unauthenticated attacker can induce an authorized backend user to follow a link such as /backend/system/eventlogs/index_onEmptyLog. Affected handlers in the backend, CMS, and system modules can truncate logs, reset settings, alter backend user state, or delete CMS templates, while URL path segments can select a target record. This issue is fixed in version 1.2.14.
Vulnerability class: CSRF (Cross-Site Request Forgery)
Published .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Wintercms Winter — versions >= 1.0.319, < 1.2.14
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-125339?
- CVE-2026-125339 is a medium-severity vulnerability in Wintercms Winter, classified under Cross-Site Request Forgery (CSRF). CVSS score: 6.1/10. Published 2026-11-10.
- How severe is CVE-2026-125339?
- Medium severity. CVSS v3 base score is 6.1 out of 10.