CVE-2026-32257 wintercms CVE debrief

Who should care

Backend users with the backend.manage_branding permission, system administrators, and security teams responsible for Winter CMS deployments should assess exposure and prioritize upgrading to version 1.2.13 or later.

Why it matters

Defenders should prioritize verifying exposure of backend users with the backend.manage_branding permission and upgrading to version 1.2.13 or later to prevent stored cross-site scripting (XSS) attacks.

• Stored cross-site scripting (XSS) can lead to unauthorized actions on behalf of backend users
• Compromise of backend user sessions may occur if exploited
• Defenders should verify exposure and prioritize upgrading to version 1.2.13 or later
• Remediation requires upgrading to version 1.2.13 or later

Technical summary

The vulnerability exists in the Brand Settings Styles field of Winter, a free, open-source content management system (CMS) based on the Laravel PHP framework. Custom CSS supplied through this field by a backend user with the backend.manage_branding permission is compiled by the LESS parser and rendered without sanitization on every backend page. This allows stored cross-site scripting (XSS) against backend users. The issue is fixed in version 1.2.13. Defenders should prioritize verifying exposure of backend users with the backend.manage_branding permission and upgrading to version 1.2.13 or later to prevent stored cross-site scripting (XSS) attacks.

Defensive priority

Defenders should prioritize verifying exposure of backend users with the backend.manage_branding permission and upgrading to version 1.2.13 or later.

Recommended defensive actions

• Verify exposure of backend users with the backend.manage_branding permission
• Upgrade to version 1.2.13 or later
• Monitor for suspicious activity on backend pages
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability exists in Winter, a free, open-source content management system (CMS) based on the Laravel PHP framework. The Brand Settings Styles field allows custom CSS, which is compiled by the LESS parser and rendered without sanitization on every backend page. This allows stored cross-site scripting (XSS) against backend users with the backend.manage_branding permission. The N

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.