GHSA-P2CH-C2C3-4XM5: Cross-Site Request Forgery in Winter CMS AJAX Routing
Vulnerability ID: GHSA-P2CH-C2C3-4XM5
CVSS Score: 8.8
Published: 2026-08-20
Winter CMS contains a routing bypass vulnerability that allows Cross-Site Request Forgery (CSRF) attacks to trigger administrative AJAX handlers. Due to case-insensitivity in PHP's method resolution and an insufficiently strict check in the backend controller system, an attacker can invoke these handler methods through lowercase HTTP GET requests, bypassing default CSRF token validation.
TL;DR
An administrative routing bypass in Winter CMS allows attackers to execute highly privileged AJAX handlers via standard HTTP GET requests through cross-site request forgery, leading to unauthorized state-changing operations.
Technical Details
- CWE ID: CWE-352, CWE-178, CWE-862
- Attack Vector: Network (Remote)
- CVSS v3.1 Score: 8.8
- Exploit Status: poc
- KEV Status: none
Affected Systems
- Winter CMS installations running versions prior to v1.2.14
Mitigation Strategies
- Upgrade to Winter CMS version 1.2.14 or above to enforce strict action name casing validations.
- Implement Web Application Firewall (WAF) rule sets to detect and block access to camelCase backend action paths over HTTP GET.
Remediation Steps:
- Run 'composer update wintercms/winter' in your project environment.
- Verify that the system is running version 1.2.14 or later.
- Check access logs for unusual GET requests to '/backend//index_on' or similar patterns.
Read the full report for GHSA-P2CH-C2C3-4XM5 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)