Skip to content
OpenAdvisories

Package · Packagist

winter/wn-system-module

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 4.9
    CVE-2026-79773

    Winter CMS before 1.2.13 Local File Inclusion via JavaScript

    Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by placing =include or =require directives in…

    wintercms winter winter/wn-system-module Packagist
  • High 8.4
    CVE-2026-79774

    Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy

    Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit…

    wintercms winter winter/wn-system-module Packagist
  • Low 2.0
    CVE-2023-52083

    Stored XSS through privileged upload of Media Manager file followed by renaming

    Winter is a free, open-source content management system. Prior to 1.2.4, users with the `media.manage_media` permission can upload files to the Media Manager and rename them after uploading. Previously, media manager files were only sanitized on upload, not o…

    wintercms winter winter/wn-system-module Packagist