GHSA-HQ84-X37P-J6Q5: Reflected Cross-Site Scripting in Winter CMS Backend Table Widget
Vulnerability ID: GHSA-HQ84-X37P-J6Q5
CVSS Score: 6.1
Published: 2026-08-20
A reflected Cross-Site Scripting (XSS) vulnerability exists in the backend Table widget of Winter CMS. The vulnerability is located within the search input template partial, where the application retrieves raw user inputs from the query parameters and renders them directly inside a raw-text script container without sanitization. An attacker can exploit this behavior by passing a crafted tag containing raw-text terminators, leading to code execution in the context of the victim's session.
TL;DR
Unsanitized user query parameters reflected inside an HTML script template block allow attackers to terminate the container early and execute arbitrary JavaScript in the victim's browser session.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-79
- Attack Vector: Network
- CVSS Score: 6.1 (Medium)
- Exploit Status: Proof of Concept
- KEV Status: Not Listed
Affected Systems
- Winter CMS Core
-
winter: < 1.2.14 (Fixed in:
1.2.14)
Code Analysis
Commit: 1b63976
Fix potential XSS vulnerability in table widget
Mitigation Strategies
- Upgrade Winter CMS core to version 1.2.14 or later
- Manually escape the search input parameter in the table template partial using the e() helper
- Implement Web Application Firewall rules to block HTML tags inside query strings
Remediation Steps:
- Navigate to the root directory of the Winter CMS installation.
- Run the composer update command to fetch the latest core update: composer update wintercms/winter.
- Verify that the file modules/backend/widgets/table/partials/_table.php reflects the changes, specifically enclosing the value attribute with the e() wrapper.
- Clear the application cache to ensure that any compiled templates are refreshed.
References
Read the full report for GHSA-HQ84-X37P-J6Q5 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)