CVE-2026-22254

Katalog CVE

CVSS 3.5 · Low EPSS 0,29%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada wintercms winter. Skor CVSS 3.1 3.5 (Low) menurut NVD.

Deskripsi (NVD)

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: cms.manage_assets. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general. This vulnerability is fixed in 1.2.10.

Rincian

Terbit di NVD

6 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.5 (Low), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 20,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wintercms/winter/security/advisories/GHSA-m7gw-rffq-rxjm patch · advisory vendor
• https://github.com/wintercms/winter/commit/8a7f74b004fcd19721764fc63af0cdb339d9fb65 patch
• https://github.com/wintercms/winter/releases/tag/v1.2.10 product · release notes