WinterCMS Winter up to 1.2.13 ImportExportController execAjaxHandlers requiredPermissions permission

Summaryinfo

A vulnerability, which was classified as critical, has been found in WinterCMS Winter up to 1.2.13. This vulnerability affects the function Backend\Classes\Controller::execAjaxHandlers of the component ImportExportController. Performing a manipulation of the argument requiredPermissions results in permission. This vulnerability is reported as CVE-2026-125337. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in WinterCMS Winter up to 1.2.13. This affects the function Backend\Classes\Controller::execAjaxHandlers of the component ImportExportController. The manipulation of the argument requiredPermissions with an unknown input leads to a permission vulnerability. CWE is classifying the issue as CWE-275. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, the ImportExportController behavior applies userHasAccess() only to the import() and export() page actions, while Backend\Classes\Controller::execAjaxHandlers() dispatches onImport(), onImportLoadForm(), onImportLoadColumnSampleForm(), onExport(), and onExportLoadForm() before those gated actions run, and the separately reachable download() action also lacks the granular export check. An authenticated backend user with a valid session and coarse access through $requiredPermissions, but without the configured import[permissions] or export[permissions], can use the import handlers to write or overwrite records and can use onExport() followed by download() to retrieve the complete dataset exposed by the export model. Controllers without granular permission keys are unaffected because userHasAccess() is intentionally default-permissive. This issue is fixed in version 1.2.14.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-125337 since 11/09/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1222 according to MITRE ATT&CK.

Upgrading to version 1.2.14 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• WinterCMS

Name

• Winter

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9
• 1.2.10
• 1.2.11
• 1.2.12
• 1.2.13

Website

• Product: https://github.com/wintercms/winter/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion