CVE-2026-79773 wintercms CVE debrief

Who should care

Winter CMS administrators and security teams should assess exposure and prioritize remediation based on the severity of potential impacts. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified. Operators of affected systems should monitor for suspicious activity on the combine route and track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

Winter CMS before 1.2.13 is vulnerable to local file inclusion via JavaScript, allowing authenticated users to disclose arbitrary server-readable files. This can lead to exposure of sensitive information such as application keys and database credentials.

• Authenticated users with cms.manage_assets permission can disclose arbitrary server-readable files
• Exposed application keys and database credentials can be read by unauthenticated visitors

Technical summary

The vulnerability is caused by a lack of proper input validation in the JavascriptImporter filter, which allows authenticated users to disclose arbitrary server-readable files. This can lead to exposure of sensitive information such as application keys and database credentials. The vulnerability has been patched in Winter CMS version 1.2.13. Defenders should prioritize remediation based on the severity of potential impacts and review compensating controls for exposed systems while remediation is scheduled and verified.

Defensive priority

Medium priority for Winter CMS administrators and security teams

Recommended defensive actions

• Update Winter CMS to version 1.2.13 or later
• Restrict access to the cms.manage_assets permission
• Monitor for suspicious activity on the combine route
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE Program record and the NVD vulnerability detail page. The Winter CMS project has released patches for the vulnerability. Evidence is limited to public CVE details and vendor advisories. Defenders should verify patch deployment and monitor for suspicious activity on the combine route. No exploit details are publicly available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.