Winter CMS, LESS Import Path Traversal File Disclosure, N/A (Patched in v1213) -DC-Aug2026-1741

Listen to this Post

🐢▶️ Listen🚀

The disclosed vulnerability resides in Winter CMS’s integration of the `wikimedia/less.php` library, which handles dynamic LESS compilation within the backend. The core flaw is that the `Less_Parser` object is instantiated without a secure import resolver, and the underlying `Less_FileManager::getFilePath()` method, when unable to resolve a candidate root directory, blindly falls back to the raw, attacker-supplied path string. This allows an authenticated backend user to inject a specially crafted `@import (inline) ““` directive into any LESS source processed by the system. Because the compiler interprets this directive as a filesystem inclusion, it will read and embed the contents of the targeted file directly into the compiled CSS output. This injection can be achieved through four distinct backend entry points. First, the `BrandSetting.custom_css` field, controlled by the `backend.manage_branding` permission, is compiled inline into every backend page’s `