CVE-2026-125341
Published:November 10, 2026
Updated:November 13, 2026
Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\Widgets\Lists::evalImageTypeValue() interpolates the result of ImageResizer::filterGetUrl() into a single-quoted image source attribute without escaping it. In a third-party plugin that renders an attacker-influenced value through an image list column, an unsupported image value is returned verbatim, can break out of the attribute, and can inject event handlers that execute when a backend user views the list. Winter core ships no image list column, so a default installation is unaffected. This issue is fixed in version 1.2.14.
Affected Packages
https://github.com/wintercms/winter.git (GITHUB):
Affected version(s) >=v1.1.0 <v1.2.14Fix Suggestion:
Update to version v1.2.14wintercms/winter (PHP):
Affected version(s) >=v1.1.0 <v1.2.14Fix Suggestion:
Update to version v1.2.14winter/wn-backend-module (PHP):
Affected version(s) >=1.1.x-dev <v1.2.14Fix Suggestion:
Update to version v1.2.14Related Resources (6)
Do you need more information?
Contact UsCVSS v4
Base Score:
2
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
HIGH
User Interaction
PASSIVE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
2
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Improper Neutralization of Input During Web Page Generation
EPSS
Base Score:
0.30