Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck

CVE-2026-79774Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy

High 8.4

In plain English

A high-severity security flaw in winter from wintercms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.4High

Exploit odds (30 days)0.8%top 43.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent models and query builders using methods like saveQuietly(), deleteQuietly(), increment(), decrement(), and newQuery() to read and modify arbitrary database records, execute arbitrary SQL, and achieve remote code execution by injecting PHP into template code sections.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	winter/wn-system-module	1.2.13	GHSA-8cfw-pcwh-v63w

Affected products (as reported)

Vendor	Product	Versions
wintercms	winter	1.2.7 – before 1.2.13

Weakness: CWE-693 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-8cfw-pcwh-v63w) vendor-advisory
Patch Commit patch
VulnCheck Advisory: Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy third-party-advisory