CVE-2026-79773 in Winter
Summary
by MITRE • 08/25/2026
Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can reference files like .env outside the theme directory, and the combined output served through the combine route becomes readable by unauthenticated visitors, exposing application keys and database credentials.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in Winter CMS versions prior to 1.2.13 represents a critical security flaw within the JavaScriptImporter filter mechanism, classified under Common Weakness Enumeration as CWE-98 Improper Control of Filename for Include Statement (PHP). This issue specifically affects authenticated users who possess the cms.manage_assets permission, allowing them to manipulate how theme assets are processed and served. The core technical failure lies in the insufficient sanitization or validation of input data within the JavaScript import logic, which permits the injection of PHP include directives such as =include or =require directly into theme JavaScript asset files. By embedding these commands, an attacker can force the server-side processing engine to interpret arbitrary file paths rather than treating them strictly as static content for client-side delivery.
The operational impact of this vulnerability is severe due to its ability to facilitate Local File Inclusion (LFI) that leads to sensitive information disclosure. When a malicious actor injects these directives, they can reference files located outside the intended theme directory structure, such as configuration files like .env or other server-readable documents containing application secrets and database credentials. The vulnerability is particularly dangerous because of how Winter CMS handles asset aggregation through its combine route. Once the file inclusion occurs on the server side, the contents of the targeted sensitive file are merged into the JavaScript output stream. This combined output is then served to clients via HTTP requests that do not require authentication, effectively bypassing access controls and exposing high-value credentials to any unauthenticated visitor who accesses the compromised asset URL.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1083 File and Directory Discovery, as it allows an attacker to enumerate and read files from the server filesystem. It also relates to CWE-209 Generation of Error Message Containing Sensitive Information if error reporting is enabled during the inclusion process, although the primary risk here is direct data exfiltration rather than stack trace leakage. The combination of authentication requirements for exploitation with public accessibility of the resulting payload creates a high-risk scenario where internal secrets are leaked to external actors without requiring further privilege escalation or complex exploit chains beyond initial access.
To mitigate this vulnerability, administrators must upgrade Winter CMS immediately to version 1.2.13 or later, which addresses the input validation flaws in the JavaScriptImporter filter. In environments where upgrading is not immediately feasible, defensive measures should include restricting file permissions on sensitive configuration files like .env so that they are not readable by the web server process unless absolutely necessary for runtime operations. Additionally, implementing strict allowlists for permitted characters and paths within asset management modules can prevent the injection of PHP control structures. Web Application Firewalls may also be configured to detect and block requests containing suspicious patterns such as =include or =require in query parameters or POST bodies associated with asset endpoints, providing an additional layer of defense against exploitation attempts.