Description

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend users can disclose arbitrary files readable by the PHP process by injecting @import (inline) directives into LESS source that the backend compiles, because the LESS parser was instantiated without a safe import resolver and fell back to the raw attacker-supplied path when no allowed root matched. The flaw is reachable through four entry points that share the same root cause: the Brand Settings custom_css field, the Editor Settings html_custom_styles field, the Mail Brand Settings colour-picker fields whose values are concatenated into LESS source without escaping, and theme .less, .sass, and .scss assets compiled when served. Both absolute paths and .. traversal outside the asset's own tree were accepted, so an attacker could read any file the web process can access, most significantly the application .env file and the APP_KEY and database credentials it contains. Exploitation requires a backend account holding one of the associated permissions, which are assigned by default to the built-in Developer role. This issue is fixed in version 1.2.13.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-26T19:16:51.840Z",
  "pubdate": "2026-08-26T19:16:51.840Z",
  "executiveSummary": "Winter CMS versions 1.2.12 and earlier are susceptible to an Arbitrary File Disclosure vulnerability caused by unsafe LESS parser import handling.\nThe vulnerability allows authenticated backend users with specific permissions to read any file accessible to the underlying PHP process, including sensitive configuration files like .env.\nThe root cause lies in the instantiation of the LESS parser without a secure import resolver, which facilitates traversal and absolute path injection when processing user-supplied style data.\nImpact includes the exposure of critical application secrets such as database credentials and the APP_KEY, potentially leading to full system compromise.\nExploitation requires a backend account with permissions to modify system or theme settings, such as those assigned to the Developer role by default.\nThis vulnerability represents a significant risk to confidentiality and integrity, as attackers can leverage disclosed credentials to escalate privileges or gain persistent access to the server environment.",
  "technicalDetails": "The vulnerability originates from the insecure instantiation of the LESS compiler within the Winter CMS backend architecture. Specifically, the LESS parser was initialized without a restricted or safe import resolver. When the compiler processes LESS source code containing @import directives, it fails to properly validate the target path against allowed root directories.\nWhen no predefined root match is identified, the parser defaults to utilizing the raw, user-supplied path. This implementation deficiency allows an attacker to provide absolute paths or directory traversal sequences (e.g., ../) to reference files outside the intended asset directories.\nThe vulnerability is exploitable via four primary backend entry points: the Brand Settings 'custom_css' field, the Editor Settings 'html_custom_styles' field, the Mail Brand Settings colour-picker fields—where values are concatenated directly into LESS sources without sanitization—and the compilation of theme-based .less, .sass, or .scss assets.\nAn attack flow involves an authenticated backend user navigating to one of the identified entry points and submitting a malicious style input. For example, injecting '@import \"../../../../.env\";' into the custom_css field triggers the compilation engine to process the directive. Because the engine lacks a restrictive import resolver, it interprets the traversal sequence and retrieves the content of the specified system file.\nThe contents of the targeted file are subsequently rendered or reflected within the backend interface or the compiled CSS output, effectively disclosing sensitive data to the attacker.\nThis vulnerability affects versions up to and including 1.2.12. The scope of impact is restricted by the need for authenticated access; however, given that the required permissions are granted by default to the Developer role, the threat surface is significant in environments with multiple administrative users.\nPost-exploitation, an attacker can obtain the application's .env file. Access to the APP_KEY can facilitate unauthorized cryptographic operations, session hijacking, or decryption of encrypted database records, while database credentials allow for unauthorized persistence and data exfiltration from the underlying storage mechanism.\nThe vulnerability was addressed in Winter CMS version 1.2.13 by implementing a secure import resolver that strictly enforces path boundaries during LESS compilation."
}