CVE-2026-22254

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22254", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-07T05:19:12.922Z", "datePublished": "2026-02-06T19:11:27.260Z", "dateUpdated": "2026-02-09T15:28:17.194Z"}, "containers": {"cna": {"title": "Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-80", "lang": "en", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 0, "baseSeverity": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/wintercms/winter/security/advisories/GHSA-m7gw-rffq-rxjm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/wintercms/winter/security/advisories/GHSA-m7gw-rffq-rxjm"}, {"name": "https://github.com/wintercms/winter/commit/8a7f74b004fcd19721764fc63af0cdb339d9fb65", "tags": ["x_refsource_MISC"], "url": "https://github.com/wintercms/winter/commit/8a7f74b004fcd19721764fc63af0cdb339d9fb65"}, {"name": "https://github.com/wintercms/winter/releases/tag/v1.2.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/wintercms/winter/releases/tag/v1.2.10"}], "affected": [{"vendor": "wintercms", "product": "winter", "versions": [{"version": "< 1.2.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T19:11:27.260Z"}, "descriptions": [{"lang": "en", "value": "Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: cms.manage_assets. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general. This vulnerability is fixed in 1.2.10."}], "source": {"advisory": "GHSA-m7gw-rffq-rxjm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-09T15:19:27.066356Z", "id": "CVE-2026-22254", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:28:17.194Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22254", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-09T15:19:27.066356Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:19:27.873Z"}}], "cna": {"title": "Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager", "source": {"advisory": "GHSA-m7gw-rffq-rxjm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 0, "attackVector": "NETWORK", "baseSeverity": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "wintercms", "product": "winter", "versions": [{"status": "affected", "version": "< 1.2.10"}]}], "references": [{"url": "https://github.com/wintercms/winter/security/advisories/GHSA-m7gw-rffq-rxjm", "name": "https://github.com/wintercms/winter/security/advisories/GHSA-m7gw-rffq-rxjm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/wintercms/winter/commit/8a7f74b004fcd19721764fc63af0cdb339d9fb65", "name": "https://github.com/wintercms/winter/commit/8a7f74b004fcd19721764fc63af0cdb339d9fb65", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wintercms/winter/releases/tag/v1.2.10", "name": "https://github.com/wintercms/winter/releases/tag/v1.2.10", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: cms.manage_assets. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general. This vulnerability is fixed in 1.2.10."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-80", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T19:11:27.260Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22254", "state": "PUBLISHED", "dateUpdated": "2026-02-09T15:28:17.194Z", "dateReserved": "2026-01-07T05:19:12.922Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-06T19:11:27.260Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "winter", "vendor": "wintercms", "versions": [{"status": "affected", "version": "< 1.2.10"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wintercms:winter:*:*:*:*:*:*:*:*", "matchCriteriaId": "588A92F0-EBF4-4A9A-A0A3-8BD4F9FDA03F", "versionEndExcluding": "1.2.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: cms.manage_assets. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general. This vulnerability is fixed in 1.2.10."}, {"lang": "es", "value": "Winter es un sistema de gesti\u00f3n de contenido (CMS) gratuito y de c\u00f3digo abierto basado en el framework PHP Laravel. Las versiones de Winter CMS anteriores a la 1.2.10 permit\u00edan a los usuarios con acceso al Gestor de Activos del CMS subir SVGs sin sanitizaci\u00f3n autom\u00e1tica. Para explotar activamente este problema de seguridad, un atacante necesitar\u00eda acceso al Backend con una cuenta de usuario con el siguiente permiso: cms.manage_assets. Los mantenedores de Winter CMS recomiendan encarecidamente que el permiso cms.manage_assets solo se reserve a administradores y desarrolladores de confianza en general. Esta vulnerabilidad est\u00e1 corregida en la 1.2.10."}], "id": "CVE-2026-22254", "lastModified": "2026-06-17T10:19:38.580", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 0.0, "baseSeverity": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 0.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22254", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-09T15:19:27.066356Z", "version": "2.0.3"}}]}, "published": "2026-02-06T20:16:10.057", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/wintercms/winter/commit/8a7f74b004fcd19721764fc63af0cdb339d9fb65"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/wintercms/winter/releases/tag/v1.2.10"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/wintercms/winter/security/advisories/GHSA-m7gw-rffq-rxjm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-80"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T22:31:26.037705+00:00", "value": {"mitigation_remediation": ["Upgrade to Winter CMS 1.2.10 or later, which removes the unsanitized SVG upload path.", "Restrict the cms.manage_assets permission to trusted administrators only; revoke it from all other roles.", "If an upgrade is not immediately possible, disable SVG uploads in the Asset Manager or implement server\u2011side sanitization of uploaded files to remove embedded scripts."], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting (XSS) in Winter CMS Asset Manager"}, "threat_synthesis": {"affected_systems": "The issue affects installations of Winter CMS older than version 1.2.10. All users who can access the Asset Manager with the cms.manage_assets permission are at risk. The fix is released in version 1.2.10 and later.", "description_and_impact": "A stored XSS flaw exists in the Asset Manager of Winter CMS versions prior to 1.2.10. The flaw allows a user with cms.manage_assets permission to upload aggressively crafted SVG files that are not automatically sanitized. When stored and later requested, the malicious script executes in any browser that loads the asset, potentially compromising confidentiality, integrity, or availability of the affected user\u2019s session. The vulnerability is categorized under CWE\u201179 and CWE\u201180.", "risk_and_exploitability": "The EPSS score is below 1% and the vulnerability is not included in the CISA KEV catalog, indicating a low probability of widespread exploitation. Exploitation requires that the attacker already possess a backend account with the cms.manage_assets privilege or compromise an account with that privilege. Attackers can then upload a malicious SVG via the Asset Manager, which when viewed by any logged\u2011in user will inject JavaScript into the page. Because the script runs with the privileges of the viewing user, an attacker could hijack sessions, steal cookies, or perform phishing actions."}}}}, "created": "2026-02-09T10:49:47.783363+00:00", "updated": "2026-04-17T22:45:29.916524+00:00", "vendors": ["wintercms", "wintercms$PRODUCT$winter"]}