CVE-2026-79773
Received Received - Intake

Local File Inclusion in Winter CMS via JavascriptImporter Filter

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can reference files like .env outside the theme directory, and the combined output served through the combine route becomes readable by unauthenticated visitors, exposing application keys and database credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-79773
EUVD
EUVD-2026-65531

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
winter_cms winter to 1.2.13 (exc)
winter_cms winter_cms to 1.2.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Winter CMS before 1.2.13 has a local file inclusion vulnerability in the JavascriptImporter filter. Authenticated users with cms.manage_assets permission can exploit =include or =require directives in theme JavaScript files to disclose arbitrary server-readable files like .env. The combined output served through the combine route becomes readable by unauthenticated visitors, exposing sensitive data such as application keys and database credentials.

Detection Guidance

Check theme JavaScript files for =include or =require directives referencing files outside the theme directory. Use commands like grep -r "=include" /path/to/themes/ or grep -r "=require" /path/to/themes/ to search for suspicious patterns.

Impact Analysis

This vulnerability allows attackers to read sensitive files on the server, such as configuration files containing credentials. Attackers can access database details, application keys, and other confidential information, potentially leading to further compromise of the system or data breaches.

Compliance Impact

This vulnerability can lead to exposure of sensitive personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. Unauthorized access to credentials or database information may result in non-compliance, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade to Winter CMS version 1.2.13 or later. Remove the cms.manage_assets permission from untrusted roles. Audit theme JavaScript files for external =include or =require directives and remove any unauthorized references.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79773. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart