CVE-2026-32258

Deferred Deferred - Pending Action

Stored XSS in Winter CMS via Unsanitized LESS Markup Styles

Publication date: 2026-08-26

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manage_editor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on every backend page, allowing stored cross-site scripting. This issue is fixed in version 1.2.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-09-09

Generated

2026-09-16

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-32258

EUVD

EUVD-2026-66633

Affected Vendors & Products

Vendor	Product	Version / Range
wintercms	winter	1.2.10
wintercms	winter	1.2.11
wintercms	winter	1.2.12
wintercms	winter	1.2.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-32258 is a stored cross-site scripting (XSS) vulnerability in Winter CMS versions 1.2.10 through 1.2.12. Authenticated backend users with the backend.manage_editor permission can inject malicious scripts via the Markup Styles field in Editor Settings. The LESS parser compiles these styles, and the output is rendered without sanitization on backend pages, enabling stored XSS attacks.

Detection Guidance

Check Winter CMS version with: composer show winter/wn-backend-module. If version is 1.2.10, 1.2.11, or 1.2.12, the system is vulnerable. Inspect backend users with backend.manage_editor permission for suspicious Markup Styles entries containing script tags.

Impact Analysis

An attacker with backend access could inject malicious scripts that execute when other users view backend pages. This could lead to unauthorized actions, data theft, or session hijacking. However, exploitation requires prior trusted access to the system, limiting the attack surface.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling stored cross-site scripting (XSS) attacks. If exploited, malicious scripts could steal sensitive user data or session tokens, violating confidentiality requirements under these regulations. The vulnerability requires authenticated backend access, which may limit exposure but still poses a risk if internal controls are insufficient.

Mitigation Strategies

Update to Winter CMS version 1.2.13 or later. If updating is not possible, manually apply the patch by modifying the renderCss() method in EditorSetting and BrandSetting models to include strip_tags() sanitization.

Hi! I’m here to help you understand CVE-2026-32258. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70