Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.5
CVE-2026-22254: Winter CMS asset manager allows malicious SVG upload
CVE-2026-22254 · published 9 months ago
Summary
Versions of Winter CMS before 1.2.10 let users who can manage assets upload SVG image files that are not cleaned, which could let an attacker run unwanted code in a visitor's browser. The risk only applies to accounts that have permission to manage assets, so keep that permission limited to trusted staff. Update Winter CMS to version 1.2.10 or newer to stop the problem.
What to do
- Update winter wn-cms-module to version 1.2.10.
- Update wintercms winter to version 1.2.10 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | winter | wn-cms-module |
<= 1.2.9 Fix: upgrade to 1.2.10
|
| – | wintercms | winter |
< 1.2.10 cpe:2.3:a:wintercms:winter:*:*:*:*:*:*:*:* |
Original advisory text
Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: cms.manage_assets. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general. This vulnerability is fixed in 1.2.10.
References
- https://github.com/advisories/GHSA-m7gw-rffq-rxjm
- https://nvd.nist.gov/vuln/detail/CVE-2026-22254 Vendor Advisory
- https://github.com/wintercms/winter/releases/tag/v1.2.10 URL
- https://github.com/wintercms/winter/security/advisories/GHSA-m7gw-rffq-rxjm Vendor Advisory
- https://github.com/wintercms/winter/commit/8a7f74b004fcd19721764fc63af0cdb339d9f... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22254... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
CWE-80Basic XSS
Timeline
Published6 Feb 2026
Updated2 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta