Winter CMS: Cross-site request forgery via AJAX handlers as page actions
Summary
Winter CMS accepts certain public AJAX handler methods as backend page actions, so a plain GET request can run state-changing backend functions without a CSRF token. An attacker can lure a logged-in backend user to a crafted link, which may truncate logs, reset settings, change backend user state or delete CMS templates. No account is needed for the attacker, but the attack requires user interaction and an authorized backend session.
Affected
- Winter CMS (winter/wn-backend-module) from 1.0.319 up to, but not including, 1.2.14
Fixed in
- Fixed in version 1.2.14
Workaround
- If an upgrade is not possible, apply the fix commit 353b23804dee2acf49fca996c72637040446824f manually (according to the advisory mirror)
- No other mitigation is known.
Exploitation
- No known exploitation in the sources checked.
- A third-party write-up with technical details is publicly available.
- CISA KEV status was not verified.
Our recommendation
- Upgrade to Winter CMS 1.2.14 or later through normal change control.
- Before upgrading, test custom plugins: public controller methods used as page actions must now be lowercase, and dashed URLs are normalised to snake_case.
- If an upgrade is not possible, apply the fix commit manually.
- Make sure backend users log out or avoid opening untrusted links while logged in to the backend.
- Review backend event logs and CMS templates for unexpected changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-125339 www.cve.org
- Winter CMS security advisory GHSA-p2ch-c2c3-4xm5 github.com
- Winter CMS fix commit 353b238 github.com
- Winter CMS release v1.2.14 github.com
- OSV GHSA-p2ch-c2c3-4xm5 osv.dev
- CVE Reports write-up GHSA-p2ch-c2c3-4xm5 cvereports.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:15.
Original description (NVD)
Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\Classes\Controller::actionExists() accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing backend AJAX handlers without a CSRF token. Because backend routes use Route::any, CSRF validation skips GET, and the default SameSite=Lax session cookie is sent on cross-site navigation, an unauthenticated attacker can induce an authorized backend user to follow a link such as /backend/system/eventlogs/index_onEmptyLog. Affected handlers in the backend, CMS, and system modules can truncate logs, reset settings, alter backend user state, or delete CMS templates, while URL path segments can select a target record. This issue is fixed in version 1.2.14.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.