{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/winter-cms/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.1,"id":"CVE-2025-61674"},{"cvss":6.1,"id":"CVE-2025-61676"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Winter CMS (1.2)","October CMS (3.7)","October CMS (4.0)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Winter CMS","October CMS"],"content_html":"\u003cp\u003eWinter CMS and October CMS contain a stored cross-site scripting (XSS) vulnerability allowing authenticated users with high-level administrative permissions to inject malicious CSS. The issue resides in the backend settings for Markup Styles and Backend Styles. When these styles are compiled via the LESS CSS parser, the resulting output is not properly sanitized before being rendered on subsequent backend pages. This allows an attacker with 'backend.manage_editor' or 'backend.manage_branding' permissions to execute arbitrary JavaScript in the context of other administrative sessions. This vulnerability is tracked as CVE-2026-32258 in Winter CMS and CVE-2025-61674 in October CMS. The fix involves implementing the \u003ccode\u003estrip_tags()\u003c/code\u003e function on the output of the \u003ccode\u003erenderCss()\u003c/code\u003e method.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability poses a risk of account takeover and unauthorized actions performed on behalf of other administrative users, including super-administrators, due to the persistent nature of the XSS payload. Successful exploitation requires an attacker to already possess specific backend management permissions, limiting the attack surface to malicious insiders or compromised administrative accounts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to Winter CMS v1.2.13 or later to receive the \u003ccode\u003estrip_tags()\u003c/code\u003e patch for \u003ccode\u003erenderCss()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eOctober CMS users should update to v3.7.13 or v4.0.12 to address the related CVE-2025-61674.\u003c/li\u003e\n\u003cli\u003eAudit users assigned the 'backend.manage_editor' and 'backend.manage_branding' permissions to ensure only trusted personnel retain these rights.\u003c/li\u003e\n\u003cli\u003eReview custom CSS and Markup Style settings in the backend for any unauthorized or suspicious injected scripts or CSS tags.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-12T16:49:19Z","date_published":"2026-08-12T16:49:14Z","id":"https://feed.craftedsignal.io/briefs/2026-08-winter-cms-xss/","summary":"Authenticated backend users can perform stored cross-site scripting (XSS) by injecting malicious content into custom CSS settings in Winter CMS and October CMS.","title":"Stored XSS in Winter CMS and October CMS Backend","url":"https://feed.craftedsignal.io/briefs/2026-08-winter-cms-xss/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["wn-backend-module"],"_cs_severities":["high"],"_cs_tags":["web-application","privilege-escalation","cms"],"_cs_type":"advisory","_cs_vendors":["Winter CMS"],"content_html":"\u003cp\u003eWinter CMS contains an improper input validation vulnerability (CVE-2026-35445) affecting the form postback mechanism. The vulnerability exists because the system fails to validate the \u003ccode\u003e_handler\u003c/code\u003e POST field submitted during form postbacks, whereas it correctly validates the \u003ccode\u003eX_WINTER_REQUEST_HANDLER\u003c/code\u003e header used in AJAX requests. This flaw allows an authenticated backend user to invoke restricted methods on controllers.\u003c/p\u003e\n\u003cp\u003eThe issue is particularly critical within the \u003ccode\u003eUsers\u003c/code\u003e controller, where the \u003ccode\u003e$requiredPermissions\u003c/code\u003e property was conditionally set to \u003ccode\u003enull\u003c/code\u003e for the \u003ccode\u003emyaccount\u003c/code\u003e action. An attacker with a low-privilege backend session can chain this postback bypass with the insecure permissions check to trigger sensitive administrative methods - including user deletion, restoration, and password resets - despite lacking the \u003ccode\u003ebackend.manage_users\u003c/code\u003e permission. All major versions of Winter CMS (1.0, 1.1, and 1.2) were vulnerable prior to version 1.2.13.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated backend users to escalate privileges and perform unauthorized administrative actions, including user deletion, restoration, and forced password resets, bypassing existing role-based access control (RBAC) configurations. This impacts the integrity and availability of user accounts and the overall security of the Winter CMS backend.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to Winter CMS version 1.2.13 or later to receive the core patch which enforces validation on the \u003ccode\u003e_handler\u003c/code\u003e POST field.\u003c/li\u003e\n\u003cli\u003eIf an immediate upgrade is not possible, apply the following manual workarounds:\u003c/li\u003e\n\u003cli\u003eModify \u003ccode\u003emodules/backend/classes/Controller.php\u003c/code\u003e to validate the \u003ccode\u003e_handler\u003c/code\u003e POST field against the \u003ccode\u003eon[A-Z][\\w+]*\u003c/code\u003e pattern before passing it to \u003ccode\u003erunAjaxHandler()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUpdate \u003ccode\u003emodules/backend/controllers/Users.php\u003c/code\u003e to remove the conditional logic that sets \u003ccode\u003e$requiredPermissions\u003c/code\u003e to \u003ccode\u003enull\u003c/code\u003e for the \u003ccode\u003emyaccount\u003c/code\u003e action.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-12T16:49:07Z","date_published":"2026-08-12T16:49:07Z","id":"https://feed.craftedsignal.io/briefs/2026-08-winter-cms-bypass/","summary":"Authenticated backend users can exploit an input validation vulnerability in the Winter CMS form postback mechanism to execute restricted controller methods, leading to unauthorized administrative actions.","title":"Improper Input Validation in Winter CMS Backend Postback","url":"https://feed.craftedsignal.io/briefs/2026-08-winter-cms-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Winter CMS","version":"https://jsonfeed.org/version/1.1"}