CVE-2026-63179 wintercms CVE debrief

Who should care

Defenders responsible for Winter CMS installations, especially those with backend user accounts, should assess exposure and prioritize remediation. They should verify exposure of sensitive files, such as the application .env file, and remediate vulnerable installations to prevent unauthorized file disclosure. Additionally, defenders should restrict access to backend user accounts and permissions to reduce exploitation risk and monitor for suspicious 1

Why it matters

CVE-2026-63179 is a vulnerability in Winter CMS that allows authenticated backend users to disclose arbitrary files readable by the PHP process. Defenders should prioritize verifying exposure and remediating vulnerable installations, especially those with backend user accounts.

• Verify exposure of sensitive files, such as the application .env file
• Remediate vulnerable installations to prevent unauthorized file disclosure
• Restrict access to backend user accounts and permissions to reduce exploitation risk
• Monitor for suspicious activity related to LESS source compilation

Technical summary

The vulnerability allows authenticated backend users to disclose arbitrary files readable by the PHP process by injecting @import (inline) directives into LESS source that the backend compiles. The flaw is reachable through four entry points: the Brand Settings custom_css field, the Editor Settings html_custom_styles field, the Mail Brand Settings colour-picker fields, and theme .less, .sass, and .scss assets compiled when served. Both absolute paths and .. traversal outside the asset's own tree were accepted, allowing an attacker to read any file the web process can access, most significantly the application .env file and the APP_KEY and database credentials it contains.

Defensive priority

Defenders should prioritize verifying exposure and remediating vulnerable Winter CMS installations, especially those with backend user accounts.

Recommended defensive actions

• Verify Winter CMS installations for exposure, especially those with backend user accounts
• Remediate vulnerable installations by upgrading to version 1.2.13
• Restrict access to backend user accounts and permissions
• Monitor for suspicious activity related to LESS source compilation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to source code changes and advisories. The vulnerability allows authenticated backend users to disclose arbitrary files readable by the PHP process by injecting @import (inline) directives into LESS source that the backend compiles. The flaw is reachable through four entry points and allows reading of any file the web process can access. Defenders should prioritize verifying exposure and remediating vulnerable to 1

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.