CVE-2026-79774 wintercms CVE debrief

Who should care

Winter CMS users, administrators of Winter CMS installations, and security teams responsible for assessing and mitigating vulnerabilities in content management systems should be aware of this critical vulnerability. They should verify their deployments, restrict template-editing permissions, and implement compensating controls to mitigate potential impacts. Security teams should prioritize patching and monitoring for suspicious activity to prevent exploitation.

Technical summary

CVE-2026-79774 is a critical vulnerability in Winter CMS versions before 1.2.13. It involves an incomplete fix for a Twig sandbox escape vulnerability in System/Twig/SecurityPolicy, allowing authenticated backend users with template-editing permissions to bypass sandbox restrictions and potentially achieve remote code execution. The vulnerability can be exploited through method forwarding using Eloquent models and query builders, enabling attackers to read and modify arbitrary database records and execute arbitrary SQL.

Defensive priority

Authenticated backend users with template-editing permissions can exploit this vulnerability to bypass sandbox restrictions, read and modify arbitrary database records, execute arbitrary SQL, and achieve remote code execution.

Recommended defensive actions

• Inventory and verify Winter CMS version
• Restrict template-editing permissions
• Implement compensating controls for database access
• Monitor for suspicious template modifications
• Apply vendor remediation when available

Evidence notes

The CVE-2026-79774 vulnerability affects Winter CMS versions before 1.2.13 and involves an incomplete fix for a Twig sandbox escape vulnerability in System/Twig/SecurityPolicy. Authenticated backend users with template-editing permissions can exploit this vulnerability to bypass sandbox restrictions. Evidence is limited to public sources and may not reflect the full scope of affected systems or potential impacts. Defenders should verify their deployments against known vulnerable versions and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.