Winter CMS: Reflected XSS in backend Table widget via search parameter
Summary
Winter CMS, a Laravel-based content management system, fails to HTML-encode the search query parameter in the backend Table widget partial. A crafted URL containing a script-closing sequence breaks out of a script template and injects markup into the backend page of an authorized user. An attacker can then run script in the victim's backend session, read the CSRF token and act with the victim's permissions; for the core Editor Settings page, a victim holding backend.manage_editor could be used to chain to server-side code execution. Exploitation requires that an authorized backend user follows a crafted link.
Affected
- Winter CMS versions 1.0.420 up to, but not including, 1.2.14
- Every Table or DataTable backend page is affected, including /backend/system/settings/update/winter/backend/editor
Fixed in
- Fixed in Winter CMS 1.2.14
Workaround
- Unknown. The vendor provides no documented workaround; upgrading to 1.2.14 is the fix.
Exploitation
- No evidence of exploitation in the wild known at the time of research.
- Not listed in the CISA KEV catalogue.
- No public proof of concept found.
Our recommendation
- Upgrade Winter CMS to version 1.2.14 or later in the next maintenance window, prioritizing internet-facing backends.
- Limit who holds the backend.manage_editor and other administrative permissions to trusted users.
- Instruct backend users not to open unknown links while logged in to the backend.
- Restrict backend access where possible, for example by IP allowlisting or VPN.
- Review backend user accounts and monitor for unexpected template or permission changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-hq84-x37p-j6q5 github.com
- Winter CMS Release v1.2.14 github.com
- Fix commit 1b63976 github.com
- CVE Record CVE-2026-125340 www.cve.org
- OpenCVE CVE-2026-125340 app.opencve.io
- OSV GHSA-hq84-x37p-j6q5 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:11.
Original description (NVD)
Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.420 until 1.2.14, the backend Table widget partial modules/backend/widgets/table/partials/_table.php emits the search query parameter without HTML encoding inside a script template. A script-closing sequence in a crafted top-level GET URL terminates the raw-text template and causes the remaining input to be parsed as backend markup, even when the widget uses searching: false. Any Table or DataTable page is a sink, including the core Editor Settings route /backend/system/settings/update/winter/backend/editor, and an unauthenticated attacker can induce an authorized backend user to follow the link. Script executing in the victim's backend origin can read the CSRF token and issue credentialed requests with that user's permissions. For the core sink, a victim with backend.manage_editor, normally a Developer-role user or superuser, can edit CMS templates, so the injected script can conditionally chain to server-side code execution; this does not grant permissions the victim lacks and does not apply automatically to every third-party plugin sink. This issue is fixed in version 1.2.14.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.