These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-63179 is a vulnerability in Winter CMS, a content management system built on the Laravel PHP framework. Authenticated backend users can disclose arbitrary files readable by the PHP process by injecting @import (inline) directives into LESS source that the backend compiles. The flaw is reachable through four entry points: the Brand Settings custom_css field, the Editor Settings html_custom_styles [truncated]
Winter CMS, built on the Laravel PHP framework, contains a vulnerability in versions up to and including 1.2.12. An authenticated backend user can read and modify attachment records belonging to other users or records due to the backend FileUpload form widget trusting an attacker-controlled file_id POST parameter. This issue is fixed in version 1.2.13.
CVE-2026-32639 is a vulnerability in Winter CMS, a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS permission to act on template types outside their authorized scope. This issue is fixed in version 1.2.13.
A SQL injection vulnerability exists in Winter CMS versions up to and including 1.2.12, specifically in the backend Filter widget's numberrange scope type when configured with a conditions key. This allows an authenticated backend user to inject arbitrary SQL and read database contents. Exploitation requires a third-party plugin to have registered a numberrange filter scope with a conditions key.
Winter CMS versions prior to 1.2.13 have a vulnerability allowing authenticated backend users to invoke arbitrary controller methods, including protected and private ones, due to insufficient validation of the handler name submitted through the form postback _handler POST field. This issue arises from the backend's failure to validate the handler name, permitting an authenticated backend user to invoke ar [truncated]
Authenticated backend users with the backend.manage_editor permission in Winter CMS 1.2.10 through 1.2.12 can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on every backend page, allowing stored cross-site scripting. This issue allows attackers to inject malicious scripts into backend pages, potentially leading to unauthorized actions or data theft. Defe [truncated]
A stored cross-site scripting (XSS) vulnerability exists in Winter, a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to version 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.manage_branding permission is compiled by the LESS parser and rendered without sanitization on every backend page, allowing stored c [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-25T16:17:29.060Z and has not been modified since then. CVE-2026-79774 is a critical vulnerability in Winter CMS versions before 1.2.13, involving an incomplete fix for a Twig sandbox escape vulnerability in System/Twig/SecurityPolicy. This allows authenticated backend users with template-editing per [truncated]
Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter. This allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. The combined output served through the combine route becomes readable by unauthenticated visitors, exposing sensitive info [truncated]