Listen to this Post
How the Vulnerability Works
This vulnerability affects Winter CMS versions prior to v1.2.14 and stems from an incomplete patch for two earlier CVEs. The issue allows authenticated users with specific administrative permissions to inject malicious JavaScript (stored XSS) through the CMS’s custom CSS functionality.
The attack surface exists in two locations within the backend. Users with the `backend.manage_branding` permission can inject custom CSS via Settings → Customize Backend → Styles. Similarly, users with the `backend.manage_editor` permission can inject through Settings → Editor Settings → Markup Styles. The input is processed through the LESS CSS parser and then rendered on every backend page.
Version 1.2.13 attempted to fix the issue by applying PHP’s `strip_tags()` function to the output of `BrandSetting::renderCss()` and EditorSetting::renderCss(). However, this fix was incomplete. The vulnerable methods cache the raw, unsanitized compiler output using Cache::forever(). The `strip_tags()` sanitization was only applied when the cache was empty—on a cache miss. On every subsequent request, when the cached value is returned (a cache hit), the unsanitized payload is served directly into the backend’s `