Listen to this Post
Affected versions of Winter CMS render the `search` query parameter without HTML encoding inside a `` in the query string terminates the template element early, and everything after it is parsed as ordinary markup in the backend document.
Any backend page rendering a Table or DataTable widget is a sink. The value is read from the global request through the `get()` helper, which — unlike `post()` — is not restricted by HTTP method, so a plain top-level GET navigation is sufficient. The template is also emitted unconditionally by the partial, so widgets using the default `searching: false` configuration are equally affected.
In Winter core the reachable route is the Editor Settings form (/backend/system/settings/update/winter/backend/editor), which renders six datatable fields and is gated by `backend.manage_editor` — assigned by default to the built-in Developer role. Third-party plugins using the datatable form widget, or the Table widget directly, expose the same sink on their own pages.
An attacker who induces a signed-in backend user to follow a crafted link executes script in that user's authenticated backend origin. The injected script can read the CSRF token published in the backend layout's `` element and issue credentialed requests as the victim, bounded only by that user's permissions. Because the core sink requires backend.manage_editor, the practical victim is a Developer-role user or superuser — who can edit CMS templates, so script running in that session can chain to server-side code execution.
This is not a permission bypass: the victim must already be authorised for the page, and the attacker gains no permission the victim does not hold.
To actively exploit this issue, an attacker needs no account of their own, but does need an authenticated backend user with access to a page rendering a Table or DataTable widget to follow an attacker-supplied link.
DailyCVE Form:
Platform: Winter CMS
Version: < 1.2.14
Vulnerability: Reflected XSS
Severity: MODERATE (CVSS 4.5)
Date: 2026-08-20
Prediction: Already patched (v1.2.14)
What Undercode Say:
Check installed version
php artisan winter:version
Apply patch manually (if unable to upgrade)
In modules/backend/widgets/table/partials/_table.php, change:
value="<?= get('search') ?>"
to:
value="<?= e(get('search')); ?>"
Verify the fix
git apply wintercms/winter@1b63976
Exploit: (Educational Purposes!)
Craft a malicious link targeting an authenticated backend user:
https://your-winter-cms.com/backend/system/settings/update/winter/backend/editor?search=%3C/script%3E%3Cimg%20src=x%20onerror=alert(%27XSS%27)%3E
The `` terminator closes the template early, and the injected `` tag executes JavaScript in the victim’s session.
Protection:
- Upgrade to Winter CMS v1.2.14 or later.
- If unable to upgrade, manually apply the patch: change `value=”“` to `value=”“` in
modules/backend/widgets/table/partials/_table.php. - Consider a restrictive Content Security Policy (CSP) at the web server or reverse proxy as a partial mitigation, though it is not a complete substitute for the fix.
Impact:
- Confidentiality: Injected script can read CSRF tokens and other sensitive data from the backend origin.
- Integrity: Attacker can issue credentialed requests as the victim, potentially modifying CMS templates and chaining to server-side code execution.
- Availability: Not directly impacted, but successful exploitation can lead to full backend compromise.
- Privilege: Exploitation does not bypass permissions; the attacker inherits the victim’s existing privileges.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
