GHSA-7MPF-4465-7FC2: GHSA-7mpf-4465-7fc2: Stored Cross-Site Scripting in Winter CMS Backend List Widget

#security #cve #cybersecurity #ghsa

GHSA-7mpf-4465-7fc2: Stored Cross-Site Scripting in Winter CMS Backend List Widget

Vulnerability ID: GHSA-7MPF-4465-7FC2
CVSS Score: 2.0
Published: 2026-08-20

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Backend List widget of Winter CMS (winter/wn-backend-module). When a list column is configured with the 'image' type and displays attacker-controlled input, the lack of sanitization in the image URL allows injection of arbitrary HTML attributes, potentially executing malicious scripts in the session of administrators viewing the list.

TL;DR

Unescaped HTML attribute interpolation in Winter CMS Backend List image columns allows stored XSS via crafted image URLs.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-79
Attack Vector: Network (AV:N)
CVSS v3.1: 2.0 (Low)
Impact: Low (Integrity Loss only)
Exploit Status: Proof-of-Concept Available
KEV Status: Not Listed

Affected Systems

Winter CMS Backend Module
winter/wn-backend-module: >= 1.1.0, < 1.2.14 (Fixed in: 1.2.14)

Code Analysis

Commit: 0941c98

Escape inputs in evalImageTypeValue to prevent attribute breakout and stored XSS.

@@ -1519,8 +1519,16 @@ protected function evalImageTypeValue($record, $column, $value)
         if ($image) {
+            $imageUrl = ImageResizer::filterGetUrl($image, $width, $height, $options);
-            return "<img src='$imageUrl' width='$width' height='$height' />";
+            return sprintf(
+                "<img src='%s' width='%s' height='%s' />",
+                e($imageUrl),
+                e($width),
+                e($height)
+            );
         }

Exploit Details

GitHub Security Advisory: Advisory documenting the verified regression testing payload.

Mitigation Strategies

Upgrade winter/wn-backend-module to 1.2.14 or later.
Manually apply contextual HTML escaping using the e() helper function inside Lists.php.

Remediation Steps:

Execute composer update winter/wn-backend-module within the project root directory.
Verify that the file modules/backend/widgets/Lists.php uses e($imageUrl) when rendering list columns of type image.
Audit stored values in columns linked to backend image lists for malicious event handlers or single quote breakouts.

References

Read the full report for GHSA-7MPF-4465-7FC2 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community