CVE-2026-63179 in Winter
Summary
by MITRE • 08/26/2026
Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend users can disclose arbitrary files readable by the PHP process by injecting @import (inline) directives into LESS source that the backend compiles, because the LESS parser was instantiated without a safe import resolver and fell back to the raw attacker-supplied path when no allowed root matched. The flaw is reachable through four entry points that share the same root cause: the Brand Settings custom_css field, the Editor Settings html_custom_styles field, the Mail Brand Settings colour-picker fields whose values are concatenated into LESS source without escaping, and theme .less, .sass, and .scss assets compiled when served. Both absolute paths and .. traversal outside the asset's own tree were accepted, so an attacker could read any file the web process can access, most significantly the application .env file and the APP_KEY and database credentials it contains. Exploitation requires a backend account holding one of the associated permissions, which are assigned by default to the built-in Developer role. This issue is fixed in version 1.2.13.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/26/2026
Winter CMS versions up to and including 1.2.12 contain a critical server-side file disclosure vulnerability that allows authenticated backend users with specific permissions to read arbitrary files accessible by the PHP process. The root cause of this flaw lies in the improper handling of LESS source code during compilation within the application's backend interface. Specifically, when processing CSS stylesheets, the system instantiates a LESS parser without configuring a safe import resolver or enforcing strict path validation rules. Consequently, if an attacker supplies an @import directive containing a raw file path that does not match any allowed root directory, the parser falls back to using the supplied path directly rather than rejecting it as invalid. This lack of input sanitization and path canonicalization enables the traversal outside intended directories and access to sensitive system files.
The vulnerability is exploitable through four distinct entry points within the Winter CMS backend interface: the Brand Settings custom_css field, the Editor Settings html_custom_styles field, Mail Brand Settings colour-picker fields where values are concatenated into LESS source without proper escaping, and theme assets in .less, .sass, or .scss formats that are compiled when served. In each scenario, an authenticated user can inject malicious @import directives containing absolute paths or directory traversal sequences such as ../ to escape the asset tree. Because the underlying PHP process typically has read access to configuration files located outside the web root, this flaw allows for the disclosure of highly sensitive data. The most significant impact is the ability to retrieve the application .env file, which contains the APP_KEY used for encryption and session management, as well as database credentials including usernames and passwords. Accessing these secrets can lead to full system compromise, allowing attackers to decrypt user sessions, forge authentication tokens, or gain direct access to the backend database.
From a classification perspective, this vulnerability aligns with CWE-200: Information Exposure, specifically involving unauthorized read access to sensitive files due to improper input validation and path traversal mechanisms. It also relates to CWE-59: Improper Link Resolution Before Path Canonicalization, as the system fails to properly resolve and restrict file paths before processing them in the LESS compiler. In terms of offensive security frameworks, this exploit maps to ATT&CK technique T1083: File and Directory Discovery, where an adversary uses valid credentials to enumerate and access sensitive files on a compromised host. The requirement for authentication means that while the impact is severe, it cannot be exploited by unauthenticated remote attackers without first obtaining backend privileges through other vectors such as credential stuffing or session hijacking.
Mitigation strategies involve upgrading Winter CMS to version 1.2.13 or later, where this issue has been resolved by implementing stricter path validation and ensuring that the LESS parser uses a secure import resolver that restricts file access to designated asset directories only. For organizations unable to upgrade immediately, it is advisable to review backend user roles and remove Developer-level permissions from any users who do not strictly require them for their job functions. Additionally, administrators should ensure that sensitive configuration files like .env are stored outside the web root with appropriate filesystem permissions restricting read access to the PHP process owner only, thereby reducing the blast radius even if a similar vulnerability were present in other components of the system.