DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-5CWR-5JXG-PCF6: GHSA-5CWR-5JXG-PCF6: Stored Cross-Site Scripting via Improper Cache Sanitization in Winter CMS Custom Styles

#security #cve #cybersecurity #ghsa

GHSA-5CWR-5JXG-PCF6: Stored Cross-Site Scripting via Improper Cache Sanitization in Winter CMS Custom Styles

Vulnerability ID: GHSA-5CWR-5JXG-PCF6
CVSS Score: 8.4
Published: 2026-08-20

Winter CMS versions prior to 1.2.14 are vulnerable to Stored Cross-Site Scripting (XSS) within the administrative backend interface. The flaw resides in the custom styles rendering pipeline for Brand Settings and Editor Settings. An attacker with privileges to modify backend branding or editor configurations can inject arbitrary JavaScript, which is written to the cache without sanitization. Subsequent page requests that result in a cache hit completely bypass output sanitization filters, leading to JavaScript execution in the sessions of other administrative users.

TL;DR

An incomplete sanitization flow in Winter CMS caches raw, unsanitized custom CSS styles. On cache hits, the raw styles are output directly into the backend interface without sanitization, allowing attackers with branding configuration permissions to achieve administrative privilege escalation via Stored XSS.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79
  • Secondary CWE ID: CWE-524
  • Attack Vector: Network
  • CVSS v3.1 Score: 8.4 (High)
  • Exploit Status: PoC / Regression Tested
  • KEV Status: Not Listed
  • Ransomware Association: No

Affected Systems

  • Winter CMS Core Engine (wintercms/winter)
  • Winter CMS: < 1.2.14 (Fixed in: 1.2.14)

Code Analysis

Commit: c95d780

Strip HTML tags from cached CSS in BrandSetting and EditorSetting to prevent Stored XSS on cache hits

--- a/modules/backend/models/BrandSetting.php\n+++ b/modules/backend/models/BrandSetting.php\n@@ -185,14 +185,13 @@ public static function renderCss()\n     {\n         $cacheKey = self::instance()->cacheKey;\n         if (Cache::has($cacheKey)) {\n-            return Cache::get($cacheKey);\n+            return strip_tags(Cache::get($cacheKey));\n         }\n \n         try {\n             $customCss = self::compileCss();\n             Cache::forever($cacheKey, $customCss);\n-        }\n-        catch (Exception $ex) {\n+        } catch (Exception $ex) {\n             $customCss = '/* ' . e($ex->getMessage()) . ' */';\n         }
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GitHub Security Advisory: Detailed description of the exploitation process including code-level test cases in the official advisory repository.

Mitigation Strategies

  • Upgrade Winter CMS to version 1.2.14 or higher to enforce sanitization on the caching layer.
  • Audit all administrative user roles and ensure that the 'backend.manage_branding' and 'backend.manage_editor' permissions are restricted only to trusted developers.
  • Deploy Web Application Firewall (WAF) rules to inspect backend customization requests for structural HTML elements.

Remediation Steps:

  1. Navigate to the project root directory.
  2. Execute 'composer update wintercms/winter' to pull the patched version (v1.2.14).
  3. Flush the application cache to clear any existing poisoned cache entries by running 'php artisan cache:clear'.
  4. Inspect the 'system_settings' table for any anomalous payloads.

References

Read the full report for GHSA-5CWR-5JXG-PCF6 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)