CVE-2026-54256

Deferred Deferred - Pending Action

Authenticated File Upload Manipulation in Winter CMS

Publication date: 2026-08-26

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend FileUpload form widget trusted an attacker-controlled file_id POST parameter when resolving the attachment it operates on, allowing an authenticated backend user to read and modify attachment records belonging to other users or records. The widget's getFileRecord() lookup resolved the posted id against the global system_files table without verifying that the file belonged to the widget's own relation, parent record, or deferred-binding session. Because all attachments share a single File model and table and attachment ids are sequential integers that are easily enumerated, a user reaching any form with a fileupload field, including the built-in My Account avatar field that requires no specific permission, could target arbitrary attachments to modify their title and description via onSaveAttachmentConfig and change their sort order via onSortAttachments, which passed posted ids straight to an unscoped update. CSRF tokens remain enforced, so exploitation requires a valid authenticated backend session with any level of access. This issue is fixed in version 1.2.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-09-09

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-54256

Affected Vendors & Products

Vendor	Product	Version / Range
winter_cms	winter_cms	to 1.2.12 (inc)
winter_cms	winter_cms	1.2.13
winter	cms	to 1.2.12 (inc)
winter	cms	1.2.13
winter	wn-backend-module	to 1.2.12 (inc)
winter	wn-backend-module	1.2.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in Winter CMS versions up to 1.2.12. The FileUpload form widget trusted an attacker-controlled file_id parameter to access or modify file attachments. Since file IDs are sequential integers, an authenticated user could manipulate this parameter to target arbitrary files in the system_files table, even those belonging to other users or records. The widget failed to verify if the file belonged to the current record or session, allowing unauthorized access to file metadata like titles, descriptions, and sort orders.

The vulnerability required a valid authenticated backend session but no specific permissions. Exploitation could occur through forms with file upload fields, including the My Account avatar field. The issue was fixed in version 1.2.13 by scoping file lookups to the widget's relation and deferred-binding session.

Detection Guidance

To detect this vulnerability, check if your Winter CMS version is 1.2.12 or earlier. Use commands like 'composer show winter/wn-backend-module' to verify the installed version. Inspect network traffic for POST requests to FileUpload endpoints containing file_id parameters with sequential or arbitrary values.

Impact Analysis

An attacker with access to a Winter CMS backend could read or modify file attachments belonging to other users, including changing titles, descriptions, or sort orders. This could lead to data leaks if sensitive files are accessed or integrity issues if files are altered. The impact is limited to metadata changes since file content itself is not directly modifiable through this vulnerability.

Compliance Impact

This vulnerability could violate compliance requirements for data protection and integrity. GDPR requires protecting personal data, and unauthorized access to file metadata may constitute a breach. HIPAA mandates safeguarding protected health information, which could be compromised if medical records' metadata is altered. The vulnerability undermines access controls and could lead to non-compliance penalties.

Mitigation Strategies

Upgrade Winter CMS to version 1.2.13 or later immediately. If upgrading is not possible, apply the manual fix to the FileUpload.php file as described in the GitHub commit. Ensure all backend users have minimal necessary permissions.

Hi! I’m here to help you understand CVE-2026-54256. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70