PT-2026-6545 · Unknown · Winter Cms

Iamunixtz · Publicado 2026-02-04 · Atualizado 2026-02-06 · CVE-2026-22254

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Baixa

Vetor base

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Winter CMS versions prior to 1.2.10

Description Winter CMS versions before 1.2.10 allow users with access to the CMS Asset Manager to upload Scalable Vector Graphics (SVGs) without proper sanitization. An attacker needs access to the Backend with a user account possessing the cms.manage assets permission to exploit this issue. The cms.manage assets permission should be restricted to trusted administrators and developers.

Recommendations Upgrade to Winter CMS version 1.2.10 or later. As a workaround, apply commit 8a7f74b004fcd19721764fc63af0cdb339d9fb65 to your Winter CMS installation manually. Restrict the cms.manage assets permission to trusted administrators and developers.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

CWE-80

Identificadores relacionados

CVE-2026-22254

GHSA-M7GW-RFFQ-RXJM

Produtos afetados

Winter Cms

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22254.json · Exploit
• https://github.com/wintercms/winter · Nota
• https://github.com/wintercms/winter/security/advisories/GHSA-m7gw-rffq-rxjm · Aviso do Fabricante
• https://github.com/wintercms/winter/commit/8a7f74b004fcd19721764fc63af0cdb339d9fb65 · Correção
• https://github.com/wintercms/winter/releases/tag/v1.2.10 · Nota
• https://osv.dev/vulnerability/GHSA-m7gw-rffq-rxjm · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-22254 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2019857592168652936 · Publicação no Twitter
• https://t.me/CVEtracker/43958 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-22254 · Nota de Segurança