XSS in Wintercms Winter
CVE-2026-22254
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: cms.manage_assets. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general. This vulnerability is fixed in 1.2.10.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
EPSS exploit prediction
EPSS: 0.003 (16.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 17th percentile — 16.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.000
Affected products
- Wintercms Winter — versions < 1.2.10
Weakness classification (CWE)
References
- github.com/wintercms/winter/security/advisories/GHSA-m7gw-rffq-rxjm (Patch, Vendor Advisory)
- github.com/wintercms/winter/commit/8a7f74b004fcd19721764fc63af0cdb339d9fb65 (Patch)
- github.com/wintercms/winter/releases/tag/v1.2.10 (Product, Release Notes)