Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck

CVE-2026-79773Winter CMS before 1.2.13 Local File Inclusion via JavaScript

Medium 4.9

In plain English

A medium-severity path traversal in winter from wintercms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.9Medium

Exploit odds (30 days)0.5%top 57.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can reference files like .env outside the theme directory, and the combined output served through the combine route becomes readable by unauthenticated visitors, exposing application keys and database credentials.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	winter/wn-system-module	1.2.13	GHSA-2223-f22x-24cq

Affected products (as reported)

Vendor	Product	Versions
wintercms	winter	0 – before 1.2.13

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-2223-f22x-24cq) vendor-advisory
Patch Commit patch
Patch Commit patch
VulnCheck Advisory: Winter CMS before 1.2.13 Local File Inclusion via JavaScript third-party-advisory