PT-2026-6545 · Unknown · Winter Cms

Iamunixtz · Published 2026-02-04 · Updated 2026-02-06 · CVE-2026-22254

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Winter CMS versions prior to 1.2.10

Description Winter CMS versions before 1.2.10 allow users with access to the CMS Asset Manager to upload Scalable Vector Graphics (SVGs) without proper sanitization. An attacker needs access to the Backend with a user account possessing the cms.manage assets permission to exploit this issue. The cms.manage assets permission should be restricted to trusted administrators and developers.

Recommendations Upgrade to Winter CMS version 1.2.10 or later. As a workaround, apply commit 8a7f74b004fcd19721764fc63af0cdb339d9fb65 to your Winter CMS installation manually. Restrict the cms.manage assets permission to trusted administrators and developers.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

CWE-80

Related Identifiers

CVE-2026-22254

GHSA-M7GW-RFFQ-RXJM

Affected Products

Winter Cms

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22254.json · Exploit
• https://github.com/wintercms/winter/security/advisories/GHSA-m7gw-rffq-rxjm · Vendor Advisory
• https://github.com/wintercms/winter/commit/8a7f74b004fcd19721764fc63af0cdb339d9fb65 · Patch
• https://osv.dev/vulnerability/GHSA-m7gw-rffq-rxjm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22254 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22254 · Security Note
• https://github.com/wintercms/winter · Note
• https://github.com/wintercms/winter/releases/tag/v1.2.10 · Note
• https://twitter.com/CVEnew/status/2019857592168652936 · Twitter Post
• https://t.me/CVEtracker/43958 · Telegram Post