CVE-2026-79773

Katalog CVE

CVSS 4.9 · Medium EPSS 0,49%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Skor CVSS 3.1 4.9 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can reference files like .env outside the theme directory, and the combined output served through the combine route becomes readable by unauthenticated visitors, exposing application keys and database credentials.

Rincian

Terbit di NVD

25 Agustus 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Deferred

CVSS 3.1

4.9 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/wintercms/storm/commit/fd673f4f32140c97c68b1ed705764b819747fbdf
• https://github.com/wintercms/winter/commit/e09c8d3526f3583cb6c3476a021b885088ecd4bd
• https://github.com/wintercms/winter/security/advisories/GHSA-2223-f22x-24cq
• https://www.vulncheck.com/advisories/winter-cms-before-local-file-inclusion-via-javascript