CVE-2026-32258: Winter CMS Stored XSS Vulnerability

CVE-2026-32258 Overview

Winter CMS is a free, open-source content management system built on the Laravel PHP framework. CVE-2026-32258 is a stored cross-site scripting (XSS) vulnerability affecting Winter CMS versions 1.2.10 through 1.2.12. Authenticated backend users holding the backend.manage_editor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on every backend page. The injected script executes in the context of any administrator who loads a backend page, enabling session theft, privilege escalation, and unauthorized backend actions. The issue is fixed in version 1.2.13.

Critical Impact
A privileged backend user can persist attacker-controlled markup that runs in every administrator's browser session, resulting in scoped account takeover across the CMS backend.

Affected Products

Winter CMS 1.2.10
Winter CMS 1.2.11
Winter CMS 1.2.12

Discovery Timeline

2026-08-26 - CVE-2026-32258 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-32258

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw [CWE-79] located in the Winter CMS backend Markup Styles feature. Backend users with the backend.manage_editor permission can submit custom CSS through the BrandSetting and EditorSetting models. The submitted content is processed by the LESS parser and then embedded directly into backend HTML output without sanitization. Because the compiled markup is rendered on every backend page, any administrator visiting the backend after payload storage triggers the injected script. The attacker gains code execution inside the authenticated session context of the victim administrator.

Root Cause

The getCustomCss() methods in modules/backend/models/BrandSetting.php and modules/backend/models/EditorSetting.php returned the compiled LESS output verbatim. HTML-sensitive characters and tag-like sequences were not stripped before rendering. An attacker could construct LESS input that, once compiled and injected into the page, closed the enclosing <style> context and introduced arbitrary markup, including <script> elements.

Attack Vector

Exploitation requires an authenticated backend account with the backend.manage_editor permission and administrator interaction with a backend page. The attacker crafts a malicious Markup Style entry containing payload characters that survive LESS compilation. When any administrator subsequently loads a backend page, the browser parses the injected markup and executes the payload under the victim's session.

php

// Security patch in BrandSetting.php and EditorSetting.php
// Source: https://github.com/wintercms/winter/commit/d28f0b9474af79cfaa80eeb9d691f7a7c4469720
            $customCss = '/* ' . e($ex->getMessage()) . ' */';
        }

-        return $customCss;
+        return strip_tags($customCss);
    }

    public static function compileCss()

The fix applies strip_tags() to the compiled CSS output, removing HTML tag sequences before the value is rendered in backend templates.

Detection Methods for CVE-2026-32258

Indicators of Compromise

Unexpected <script>, <img>, or event-handler markup inside stored BrandSetting or EditorSetting custom CSS records in the Winter CMS database.
Backend session tokens or CSRF tokens transmitted to unfamiliar external domains from administrator browsers.
New or modified backend user accounts created shortly after a Markup Styles configuration change.

Detection Strategies

Audit the system_settings table for brand_setting and editor_setting rows containing angle brackets, javascript: URIs, or on*= attributes inside custom CSS fields.
Review Winter CMS backend audit logs for updates to Markup Styles by accounts holding the backend.manage_editor permission.
Inspect web server access logs for outbound requests initiated from backend pages to unexpected third-party hosts.

Monitoring Recommendations

Alert on modifications to backend settings tables performed by non-administrator roles.
Deploy a Content Security Policy in report-only mode on the CMS backend to surface unexpected inline script execution.
Track authentication anomalies for administrator accounts following any Markup Styles change event.

How to Mitigate CVE-2026-32258

Immediate Actions Required

Upgrade Winter CMS to version 1.2.13 or later, which applies strip_tags() sanitization to compiled custom CSS output.
Review all existing BrandSetting and EditorSetting records for previously injected payloads and remove them before upgrading.
Rotate backend user credentials and invalidate active sessions if any administrator loaded a compromised backend page.

Patch Information

The fix is available in Winter CMS 1.2.13. See the GitHub Security Advisory GHSA-vgp4-2fc4-qff2 and the remediation commit d28f0b9 for full technical details.

Workarounds

Revoke the backend.manage_editor permission from all non-essential backend users until the upgrade is complete.
Restrict backend access by IP address or VPN to limit exposure of the vulnerable interface.
Enforce a strict backend Content Security Policy that blocks inline script execution.

bash

# Update Winter CMS to the fixed release via Composer
composer require wintercms/winter:^1.2.13
php artisan winter:up