CVE-2026-22254
SVG Upload Sanitization Bypass in Winter CMS Asset Manager
Publication date: 2026-02-06
Last updated on: 2026-02-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wintercms | winter | to 1.2.10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-80 | The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-22254 is a security vulnerability in Winter CMS versions before 1.2.10 related to the CMS Asset Manager module. It allows users with the cms.manage_assets permission to upload SVG files without automatic sanitization. This means that potentially malicious SVG content could be uploaded, which might contain harmful scripts or code.
To exploit this vulnerability, an attacker must have backend access with the cms.manage_assets permission, which is recommended to be restricted to trusted administrators and developers. The vulnerability is classified as CWE-80, indicating improper neutralization of script-related HTML tags, potentially enabling cross-site scripting (XSS) attacks via SVG files.
The issue was fixed in Winter CMS version 1.2.10 by implementing automatic sanitization of SVG files upon upload through the CMS Asset Manager.
How can this vulnerability impact me? :
If exploited, this vulnerability could allow an attacker with backend access and the cms.manage_assets permission to upload malicious SVG files that contain harmful scripts. This could lead to cross-site scripting (XSS) attacks within the CMS environment.
However, the impact is limited because exploitation requires high privileges and user interaction. The CVSS v3.1 base score is 0.0, indicating no direct impact on confidentiality, integrity, or availability of the system.
The main risk is to the security of the CMS backend environment and potentially to users interacting with the CMS if malicious SVG content is rendered without sanitization.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves the upload of SVG files without sanitization through the Winter CMS Asset Manager by users with the cms.manage_assets permission.'}, {'type': 'paragraph', 'content': 'Detection can focus on identifying SVG file uploads to the CMS Asset Manager and verifying whether those SVG files have been sanitized.'}, {'type': 'paragraph', 'content': 'Since the vulnerability is related to the CMS backend and file uploads, network detection might be limited, but you can audit backend user actions and uploaded files.'}, {'type': 'list_item', 'content': 'Check the version of Winter CMS; versions before 1.2.10 are vulnerable.'}, {'type': 'list_item', 'content': 'Review uploaded SVG files in the theme assets directory for presence of unsanitized or potentially malicious content.'}, {'type': 'list_item', 'content': 'Audit user accounts with cms.manage_assets permission to ensure only trusted users have this permission.'}, {'type': 'paragraph', 'content': 'Specific commands are not provided in the resources, but general suggestions include:'}, {'type': 'list_item', 'content': "Use file system commands to list SVG files uploaded recently, e.g., `find /path/to/winter/themes -name '*.svg' -mtime -7` to find SVG files uploaded in the last 7 days."}, {'type': 'list_item', 'content': 'Manually inspect SVG files for suspicious scripts or tags.'}, {'type': 'list_item', 'content': 'Check Winter CMS version via the backend or by inspecting the installed version to confirm if it is before 1.2.10.'}] [2, 3]
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade Winter CMS to version 1.2.10 or later, where the vulnerability is fixed by automatic sanitization of SVG files upon upload.
If upgrading immediately is not possible, manually applying the fix from commit 8a7f74b (which implements SVG sanitization during uploads) can serve as a workaround.
Additionally, restrict the cms.manage_assets permission to only trusted administrators and developers to reduce the risk of exploitation.
- Upgrade Winter CMS to version 1.2.10 or later.
- Apply the patch from commit 8a7f74b if upgrade is not immediately feasible.
- Review and limit user permissions, especially cms.manage_assets, to trusted users only.