CVE-2026-79774
Received Received - Intake

Twig Sandbox Escape in Winter CMS

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent models and query builders using methods like saveQuietly(), deleteQuietly(), increment(), decrement(), and newQuery() to read and modify arbitrary database records, execute arbitrary SQL, and achieve remote code execution by injecting PHP into template code sections.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-79774
EUVD
EUVD-2026-65532

Affected Vendors & Products

Showing 15 associated CPEs
Vendor Product Version / Range
winter cms 1.2.7
winter cms 1.2.8
winter cms 1.2.9
winter cms 1.2.10
winter cms 1.2.11
winter cms 1.2.12
winter cms From 1.2.13 (exc)
winter_cms winter 1.2.7
winter_cms winter 1.2.8
winter_cms winter 1.2.9
winter_cms winter 1.2.10
winter_cms winter 1.2.11
winter_cms winter 1.2.12
winter_cms winter From 1.2.13 (exc)
winter_cms winter_cms to 1.2.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Twig sandbox escape flaw in Winter CMS versions before 1.2.13. It allows authenticated backend users with template-editing permissions to bypass security restrictions. Attackers can exploit method forwarding through Eloquent models and query builders using methods like saveQuietly(), deleteQuietly(), increment(), decrement(), and newQuery() to read and modify database records, execute arbitrary SQL, and achieve remote code execution by injecting PHP into template code sections.

Detection Guidance

Check Winter CMS versions between 1.2.7 and 1.2.12 for the affected winter/wn-system-module package. Inspect Twig template files for unauthorized PHP code injection or suspicious method calls like saveQuietly(), deleteQuietly(), increment(), decrement(), or newQuery(). Review database access logs for unusual queries or modifications by non-admin users.

Impact Analysis

This vulnerability can allow attackers with specific permissions to read or modify sensitive database records, execute arbitrary SQL commands including DDL, steal sensitive data such as admin credentials, and achieve remote code execution by injecting PHP code into CMS templates. It requires authenticated access with permissions like cms.manage_pages, cms.manage_layouts, or cms.manage_partials.

Compliance Impact

This vulnerability allows unauthorized read and modification of database records, including sensitive data like admin credentials. This could lead to breaches of confidentiality required by GDPR and HIPAA, as attackers may access or alter protected health or personal data without authorization.

Mitigation Strategies

Upgrade Winter CMS to version 1.2.13 or later immediately. Clear the Twig template cache after upgrade. Restrict backend template-editing permissions to only trusted administrators. Temporarily disable template editing for users without verified need until patching is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79774. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart