CVE-2026-54256: Winter CMS Privilege Escalation Vulnerability

CVE-2026-54256 Overview

CVE-2026-54256 is a broken access control vulnerability [CWE-284] in Winter CMS, a content management system built on the Laravel PHP framework. The backend FileUpload form widget trusts an attacker-controlled file_id POST parameter when resolving attachments. An authenticated backend user with any level of access can read and modify attachment records that belong to other users or records. Any form containing a fileupload field, including the built-in My Account avatar field that requires no specific permission, becomes an attack surface. The issue affects versions up to and including 1.2.12 and is fixed in version 1.2.13.

Critical Impact
Authenticated backend users can enumerate sequential attachment IDs and modify title, description, and sort order of arbitrary files stored anywhere in the CMS.

Affected Products

Winter CMS versions up to and including 1.2.12
Winter CMS backend FileUpload form widget (modules/backend/formwidgets/FileUpload.php)
Winter CMS FormModelWidget trait (modules/backend/traits/FormModelWidget.php)

Discovery Timeline

2026-08-26 - CVE-2026-54256 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-54256

Vulnerability Analysis

The vulnerability stems from missing authorization checks in the Winter CMS backend FileUpload form widget. The widget's getFileRecord() method resolves the posted file_id against the global system_files table without verifying that the file belongs to the widget's own relation, parent record, or deferred-binding session. All attachments in Winter CMS share a single File model and table, and attachment IDs are sequential integers.

An attacker with a low-privileged backend session can enumerate these IDs and target arbitrary attachments. The onSaveAttachmentConfig endpoint allows modification of a file's title and description. The onSortAttachments endpoint passes posted IDs directly to an unscoped update, changing the sort order of files owned by any user or record. Cross-Site Request Forgery (CSRF) tokens remain enforced, so exploitation requires a valid authenticated backend session.

Root Cause

The root cause is an Insecure Direct Object Reference. The getFileRecord() lookup treats the client-supplied file_id as trusted input and queries the global file table without applying scoping constraints tied to the current form context, parent model, or session-bound deferred bindings.

Attack Vector

An authenticated backend user, including a user restricted to only the My Account avatar upload form, submits a crafted POST request to onSaveAttachmentConfig or onSortAttachments. The request includes a valid CSRF token and an enumerated file_id targeting another user's or record's attachment. The unscoped update writes the attacker-supplied metadata to the target file record.

php

// Patch: modules/backend/formwidgets/FileUpload.php
// Before: procedural imports and reliance on global helpers
-<?php namespace Backend\FormWidgets;
-use Db;
-use Input;
-use Event;
-use Request;
-use Response;
-use Validator;
-use Backend\Widgets\Form;

// After: explicit facade imports and use of the File model for scoped lookups
+<?php
+namespace Backend\FormWidgets;
+use Backend\Classes\FormField;
+use Backend\Classes\FormWidgetBase;
+use Backend\Widgets\Form;
+use Illuminate\Support\Facades\Response;
+use System\Models\File;
+use Winter\Storm\Support\Facades\DB;
+use Winter\Storm\Support\Facades\Input;

Source: Winter CMS patch commit 9cb0ae5

Detection Methods for CVE-2026-54256

Indicators of Compromise

POST requests to onSaveAttachmentConfig or onSortAttachments containing file_id values that do not match any attachment tied to the requesting user's session or the currently loaded parent record.
Sequential enumeration patterns in backend request logs targeting the system_files ID space.
Unexpected changes to title, description, or sort_order columns in the system_files table without corresponding legitimate admin activity.

Detection Strategies

Audit web server and application logs for backend requests to the FileUpload widget endpoints originating from low-privileged accounts, especially the My Account avatar form.
Correlate database write events on system_files with the authenticated user context expected to own each record.
Alert on rapid, incrementing file_id values in POST bodies from a single session, which indicates ID enumeration.

Monitoring Recommendations

Enable verbose logging on the Winter CMS backend module and forward logs to a centralized SIEM for correlation.
Monitor the system_files table for out-of-band metadata changes using database audit triggers.
Track backend authentication events tied to accounts that have access only to profile or avatar forms.

How to Mitigate CVE-2026-54256

Immediate Actions Required

Upgrade Winter CMS to version 1.2.13, which enforces that the FileUpload widget only operates on file records related to its own form context.
Review backend user accounts and revoke unnecessary sessions until the upgrade is complete.
Inspect the system_files table for unauthorized modifications to title, description, and sort_order fields.

Patch Information

The fix is delivered in Winter CMS 1.2.13. See the GitHub Security Advisory GHSA-3277-h8g9-qj5f and the patch commit 9cb0ae5. The patch refactors FileUpload.php and FormModelWidget.php to resolve file records only through the widget's relation, parent record, or deferred-binding session.

Workarounds

Restrict backend access to trusted administrators until the upgrade to 1.2.13 is applied.
Disable or remove forms containing fileupload fields that are exposed to low-privileged users, including the My Account avatar field.
Apply web application firewall rules that block POST requests to onSaveAttachmentConfig and onSortAttachments from accounts outside an allowlist.

bash

# Upgrade Winter CMS via Composer
composer require wintercms/winter:^1.2.13
php artisan winter:up