CVE-2026-79773CWE-22path-traversal

CVE-2026-79773

Medium · published August 25, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
41.4
In the wild
Unconfirmed
What it is

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manage_assets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can reference files like .env outside the theme directory, and the combined output served through the combine route becomes readable by unauthenticated visitors, exposing application keys and database credentials.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00493 · 41.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-25T20:17Z
References (4)
https://github.com/wintercms/storm/commit/fd673f4f32140c97c68b1ed705764b819747fbdf · [email protected]https://github.com/wintercms/winter/commit/e09c8d3526f3583cb6c3476a021b885088ecd4bd · [email protected]https://github.com/wintercms/winter/security/advisories/GHSA-2223-f22x-24cq · [email protected]https://www.vulncheck.com/advisories/winter-cms-before-local-file-inclusion-via-javascript · [email protected]
EPSS history
Timeline
  • 27 AUG 06:46Z
    EPSS moved — → 0%
    epss
  • 25 AUG 15:16Z
    Winter CMS before 1.2.13 Local File Inclusion via JavaScript
    cvelistv5