Description

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manage_editor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on every backend page, allowing stored cross-site scripting. This issue is fixed in version 1.2.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-26T17:16:53.410Z",
  "pubdate": "2026-08-26T17:16:53.410Z",
  "executiveSummary": "Winter CMS (versions 1.2.10 through 1.2.12) contains a stored cross-site scripting (XSS) vulnerability within its backend markup style management system.\nThe vulnerability arises due to the application failing to properly sanitize custom Markup Styles that are subsequently compiled by the LESS parser.\nAn attacker with the backend.manage_editor permission can inject malicious JavaScript payloads into these styles, which execute in the context of any backend user viewing pages where these styles are rendered.\nThis vulnerability grants authenticated attackers the ability to execute arbitrary code within the victim's browser session.\nSuccessful exploitation allows for the potential theft of administrative session tokens, unauthorized execution of backend actions, and the compromise of sensitive administrative data.\nThe risk is mitigated by updating to version 1.2.13 or higher, where proper sanitization mechanisms have been implemented.",
  "technicalDetails": "The root cause of this vulnerability is the insecure handling of user-supplied input within the Markup Styles editor, a component of the Winter CMS backend.\nThe application accepts custom LESS code through the editor, which is then processed by a LESS parser. During this process, the input is not subjected to adequate sanitization or output encoding before it is persisted in the database and subsequently rendered on administrative backend pages.\nExploitation requires the attacker to possess the 'backend.manage_editor' permission, which is typically assigned to administrative or privileged user roles. An attacker authenticated with these credentials can submit a crafted Markup Style containing JavaScript payloads, leveraging LESS syntax features to obscure or directly inject scripts that bypass simple input filters.\nWhen a backend user loads a page where the compiled LESS is rendered, the browser interprets the injected malicious content as legitimate script code. Because the script executes within the context of the backend session, it gains access to sensitive data, including session cookies, CSRF tokens, and the ability to perform administrative actions on behalf of the victim.\nThe attack flow is as follows: 1) The authenticated attacker navigates to the Markup Styles configuration interface. 2) The attacker submits a malicious style definition containing an XSS payload. 3) The CMS backend saves this payload into the system database. 4) The CMS compiler processes the style, retaining the malicious script. 5) When an administrator or other user accesses a backend page, the application embeds the compiled (and malicious) output. 6) The victim's browser executes the script, leading to unauthorized actions or data exfiltration.\nThis vulnerability is restricted to authenticated users with specific backend permissions and poses a significant threat to the integrity and confidentiality of the CMS management interface."
}