Winter CMS - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/winter-cms/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 12 Aug 2026 16:49:14 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored XSS in Winter CMS and October CMS Backendhttps://feed.craftedsignal.io/briefs/2026-08-winter-cms-xss/Wed, 12 Aug 2026 16:49:14 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-winter-cms-xss/Authenticated backend users can perform stored cross-site scripting (XSS) by injecting malicious content into custom CSS settings in Winter CMS and October CMS.Winter CMS and October CMS contain a stored cross-site scripting (XSS) vulnerability allowing authenticated users with high-level administrative permissions to inject malicious CSS. The issue resides in the backend settings for Markup Styles and Backend Styles. When these styles are compiled via the LESS CSS parser, the resulting output is not properly sanitized before being rendered on subsequent backend pages. This allows an attacker with 'backend.manage_editor' or 'backend.manage_branding' permissions to execute arbitrary JavaScript in the context of other administrative sessions. This vulnerability is tracked as CVE-2026-32258 in Winter CMS and CVE-2025-61674 in October CMS. The fix involves implementing the strip_tags() function on the output of the renderCss() method.

Impact

The vulnerability poses a risk of account takeover and unauthorized actions performed on behalf of other administrative users, including super-administrators, due to the persistent nature of the XSS payload. Successful exploitation requires an attacker to already possess specific backend management permissions, limiting the attack surface to malicious insiders or compromised administrative accounts.

Recommendation

  • Upgrade to Winter CMS v1.2.13 or later to receive the strip_tags() patch for renderCss().
  • October CMS users should update to v3.7.13 or v4.0.12 to address the related CVE-2025-61674.
  • Audit users assigned the 'backend.manage_editor' and 'backend.manage_branding' permissions to ensure only trusted personnel retain these rights.
  • Review custom CSS and Markup Style settings in the backend for any unauthorized or suspicious injected scripts or CSS tags.
]]>lowadvisoryImproper Input Validation in Winter CMS Backend Postbackhttps://feed.craftedsignal.io/briefs/2026-08-winter-cms-bypass/Wed, 12 Aug 2026 16:49:07 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-winter-cms-bypass/Authenticated backend users can exploit an input validation vulnerability in the Winter CMS form postback mechanism to execute restricted controller methods, leading to unauthorized administrative actions.Winter CMS contains an improper input validation vulnerability (CVE-2026-35445) affecting the form postback mechanism. The vulnerability exists because the system fails to validate the _handler POST field submitted during form postbacks, whereas it correctly validates the X_WINTER_REQUEST_HANDLER header used in AJAX requests. This flaw allows an authenticated backend user to invoke restricted methods on controllers.

The issue is particularly critical within the Users controller, where the $requiredPermissions property was conditionally set to null for the myaccount action. An attacker with a low-privilege backend session can chain this postback bypass with the insecure permissions check to trigger sensitive administrative methods - including user deletion, restoration, and password resets - despite lacking the backend.manage_users permission. All major versions of Winter CMS (1.0, 1.1, and 1.2) were vulnerable prior to version 1.2.13.

Impact

Successful exploitation allows authenticated backend users to escalate privileges and perform unauthorized administrative actions, including user deletion, restoration, and forced password resets, bypassing existing role-based access control (RBAC) configurations. This impacts the integrity and availability of user accounts and the overall security of the Winter CMS backend.

Recommendation

  • Upgrade to Winter CMS version 1.2.13 or later to receive the core patch which enforces validation on the _handler POST field.
  • If an immediate upgrade is not possible, apply the following manual workarounds:
  • Modify modules/backend/classes/Controller.php to validate the _handler POST field against the on[A-Z][\w+]* pattern before passing it to runAjaxHandler().
  • Update modules/backend/controllers/Users.php to remove the conditional logic that sets $requiredPermissions to null for the myaccount action.
]]>highadvisoryweb-applicationprivilege-escalationcms