GHSA-8CFW-PCWH-V63W: Authenticated Twig Sandbox Escape and Remote Code Execution in Winter CMS
Vulnerability ID: GHSA-8CFW-PCWH-V63W
CVSS Score: 8.5
Published: 2026-08-20
An authenticated Twig sandbox escape vulnerability in Winter CMS allows users with template-editing privileges to bypass sandbox restrictions and execute arbitrary PHP code. This vulnerability represents a complete bypass of the sandbox protections introduced by the previous patch for CVE-2024-54149.
TL;DR
A sandbox escape bypass in Winter CMS allows authenticated users with template management access to execute arbitrary code via dynamic magic method forwarding, higher-order collection parameters, and custom AST node manipulation.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-94
- Attack Vector: Network (Authenticated)
- CVSS: 8.5 (High)
- Exploit Status: PoC Available
- Mitigation Status: Patched in v1.2.13
Affected Systems
- Winter CMS Core Module
-
Winter CMS: < 1.2.13 (Fixed in:
1.2.13)
Code Analysis
Commit: 725bbcd
Improve Twig sandbox security controls against model and collection manipulation
Commit: fb88e6f
Implement flat class-specific blocklist in SecurityPolicy
Exploit Details
- GitHub: WinterCMS Authenticated RCE Exploit via Twig Sandbox Escape in CMS SecurityPolicy
Mitigation Strategies
- Upgrade to Winter CMS v1.2.13 or higher.
- Restrict backend template editing permissions to fully trusted users.
- Implement filesystem write restrictions on directories containing themes and compiled views.
Remediation Steps:
- Run 'composer update winter/composer' to fetch the latest Winter CMS packages.
- Verify that the system module is updated to v1.2.13 or higher.
- Review the administrative permissions matrix and audit accounts with access to CMS layouts, pages, and partials.
- Configure log monitoring to track SecurityNotAllowedMethodError exceptions.
References
Read the full report for GHSA-8CFW-PCWH-V63W on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)