Description

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS permission to act on template types outside their authorized scope. The CMS controller gated access to the section as a whole using OR-logic across its five permissions, but individual handlers such as onSave(), onDelete(), and onDeleteTemplates() did not verify that the user held the specific permission for the requested template type, so a user with only cms.manage_pages could craft AJAX requests to delete layouts, modify partials, or read content files. Separately, the AssetList widget was registered for any user who passed the controller gate regardless of the cms.manage_assets permission, and its onUpload() handler omitted the theme-validation call present on the other mutating handlers, permitting unauthorized file uploads into the active theme's asset directory. Exploitation requires an authenticated backend account holding at least one of the CMS Theme Editor permissions. This issue is fixed in version 1.2.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-26T18:16:30.427Z",
  "pubdate": "2026-08-26T18:16:30.427Z",
  "executiveSummary": "Winter CMS versions up to and including 1.2.12 contain a critical improper authorization vulnerability within the Theme Editor and AssetList components. The vulnerability stems from insufficient permission validation in backend AJAX handlers, allowing authenticated users with limited CMS permissions to perform unauthorized administrative actions beyond their assigned scope.\nThe vulnerability allows an authenticated backend user—holding any single CMS-related permission—to bypass granular access controls for sensitive operations such as deleting layouts, modifying partials, or performing unauthorized file uploads into the active theme's asset directory.\nThe risk is significant as it permits lateral privilege escalation within the CMS backend, potentially leading to arbitrary code execution or site defacement through the manipulation of theme templates and malicious file uploads. Exploitation requires an active, authenticated backend session. This vulnerability is remediated in Winter CMS version 1.2.13.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper implementation of access control logic within the Winter CMS backend controller. While the CMS controller implements a high-level gate using OR-logic across five distinct permissions to authorize access to the CMS section, the individual AJAX handlers, specifically onSave(), onDelete(), and onDeleteTemplates(), fail to enforce granular, per-template-type authorization checks.\nUnder normal circumstances, users should only be able to interact with template types for which they possess specific permissions (e.g., cms.manage_pages, cms.manage_assets). Because the handlers do not verify if the current user possesses the specific permission required for the targeted template type, a user with limited access (e.g., only cms.manage_pages) can issue crafted AJAX requests to manipulate resources outside their authorized scope, such as layouts or partials.\nFurthermore, the AssetList widget exhibits an additional flaw where it is registered for any user who successfully clears the initial controller gate, effectively ignoring the cms.manage_assets permission requirement. The onUpload() handler for this widget fails to invoke the mandatory theme-validation call that is present in other mutating handlers. This allows an unauthorized backend user to upload arbitrary files directly into the active theme's asset directory.\nThe attack flow for the Theme Editor vulnerability involves an authenticated user crafting a malicious AJAX request directed at the controller handlers. By manipulating the parameters sent to the backend, the attacker forces the system to execute operations on templates that the attacker should not have access to modify or delete. For the AssetList vulnerability, the attacker bypasses the file upload restrictions by interacting directly with the onUpload() handler, facilitating the injection of malicious files into the web-accessible asset directory.\nThe scope of impact includes unauthorized modification or deletion of sensitive system files, which can lead to service degradation or compromise of the application's template logic. Post-exploitation impact may include the deployment of web shells or malicious scripts disguised as theme assets if the attacker can successfully leverage the file upload vulnerability. The vulnerability affects all versions of Winter CMS up to and including 1.2.12."
}