CVE-2026-32257

Deferred Deferred - Pending Action

Stored XSS in Winter CMS via Unsanitized Custom CSS

Publication date: 2026-08-26

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.manage_branding permission is compiled by the LESS parser and rendered without sanitization on every backend page, allowing stored cross-site scripting against backend users. This issue is fixed in version 1.2.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-09-09

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-32257

EUVD

EUVD-2026-66632

Affected Vendors & Products

Vendor	Product	Version / Range
wintercms	winter	1.2.13
wintercms	wn_backend_module	to 1.2.13 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-32257 is a stored Cross-Site Scripting (XSS) vulnerability in Winter CMS. It affects versions 1.2.12 and earlier of the winter/wn-backend-module package. The issue occurs when custom CSS provided through the backend's Brand Settings is compiled by the LESS parser and rendered without sanitization on every backend page. This allows attackers with backend.manage_branding permission to inject malicious scripts.

Detection Guidance

Check Winter CMS version with: composer show winter/wn-backend-module. If version is 1.2.12 or earlier, the system is vulnerable. Inspect backend Brand Settings Styles field for suspicious CSS or script tags.

Impact Analysis

An attacker with backend access could exploit this to execute malicious scripts in the context of other backend users. This could lead to session hijacking, unauthorized actions, or data theft. The impact is limited to backend users since the attack requires existing backend access with administrative privileges.

Compliance Impact

This vulnerability could potentially violate compliance requirements that mandate protection against unauthorized data access or modification, such as GDPR's integrity principle or HIPAA's security rule. Exploitation could lead to unauthorized data exposure or modification, triggering non-compliance penalties if sensitive data is compromised.

Mitigation Strategies

Upgrade Winter CMS to version 1.2.13 or later. If upgrading is not possible, manually apply the commit d28f0b9474af79cfaa80eeb9d691f7a7c4469720 to sanitize CSS output.

Hi! I’m here to help you understand CVE-2026-32257. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70