CVE-2026-63179: Winter CMS Information Disclosure Vulnerability

CVE-2026-63179 Overview

CVE-2026-63179 is a path traversal vulnerability [CWE-22] in Winter CMS, a content management system built on the Laravel PHP framework. Versions up to and including 1.2.12 allow authenticated backend users to disclose arbitrary files readable by the PHP process. Attackers inject @import directives into LESS source that the backend compiles. The LESS parser was instantiated without a safe import resolver and fell back to attacker-supplied paths when no allowed root matched. The flaw is fixed in Winter CMS 1.2.13.

Critical Impact
Authenticated attackers with the built-in Developer role can read arbitrary files accessible to the web process, including the application .env file containing APP_KEY and database credentials.

Affected Products

Winter CMS versions up to and including 1.2.12
Winter Storm library (wintercms/storm) LESS compiler component
Winter CMS Backend module (Brand Settings, Editor Settings, Mail Brand Settings)

Discovery Timeline

2026-08-26 - CVE-2026-63179 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-63179

Vulnerability Analysis

The vulnerability is a Path Traversal weakness reachable through four backend entry points that share the same root cause. The Brand Settings custom_css field, the Editor Settings html_custom_styles field, the Mail Brand Settings colour-picker fields whose values are concatenated into LESS source without escaping, and theme .less, .sass, and .scss assets all funnel user input into the LESS parser. Both absolute paths and .. traversal outside the asset's own tree were accepted. An attacker can read any file accessible to the web process, including the application .env file with its APP_KEY and database credentials.

Root Cause

The LESS parser was instantiated without a safe import resolver. When no allowed root matched an @import target, the parser fell back to the raw attacker-supplied path. Additionally, the PathResolver::within() helper used a naive prefix match on resolved paths, which would accept sibling directories whose names shared a string prefix with an allowed root.

Attack Vector

Exploitation requires an authenticated backend account with one of the associated permissions, which are assigned by default to the built-in Developer role. The attacker submits crafted LESS content containing an inline @import directive that references an absolute path or traverses outside the asset tree using .. sequences. When the backend compiles the LESS source, the parser reads the target file and includes its contents in the compilation error output or generated CSS, disclosing the file to the attacker.

php

// Security patch in src/Filesystem/PathResolver.php
// Fixes prefix-match flaw in the within() directory check
public static function within(string $path, string $directory): bool
{
    $directory = static::resolve($directory);
    $path = static::resolve($path);

    if ($directory === false || $path === false) {
        return false;
    }

    if ($path === $directory) {
        return true;
    }

    return starts_with($path, rtrim($directory, '/\\') . DIRECTORY_SEPARATOR)
        || starts_with($path, rtrim($directory, '/\\') . '/');
}

Source: Winter Storm commit af770331

Detection Methods for CVE-2026-63179

Indicators of Compromise

Unexpected @import directives referencing absolute paths or .. sequences in Brand Settings custom_css or Editor Settings html_custom_styles database records
Backend audit log entries showing edits by Developer-role accounts to LESS-compiled fields immediately followed by CSS compilation errors
Web server error logs containing LESS parser failures referencing sensitive filesystem paths such as .env, /etc/passwd, or Laravel config/ files
Anomalous access to the application .env file or database credential reads from the PHP process

Detection Strategies

Review Winter CMS database tables backend_settings and system_settings for stored LESS content containing @import statements with suspicious paths
Audit theme asset directories for .less, .sass, and .scss files containing @import directives that reference paths outside the theme tree
Monitor the Winter CMS compiled asset cache directory for CSS output containing contents that resemble environment configuration or application secrets

Monitoring Recommendations

Enable and forward Winter CMS backend activity logs to a central logging platform to track configuration changes by Developer-role users
Alert on any modification to custom_css, html_custom_styles, or Mail Brand Settings colour fields containing the substring @import
Rotate APP_KEY and database credentials if backend logs show unexplained access to the affected settings fields prior to patching

How to Mitigate CVE-2026-63179

Immediate Actions Required

Upgrade Winter CMS to version 1.2.13, which introduces the LessImportResolver and hardens the PathResolver::within() boundary check
Audit all backend accounts holding the Developer role and remove the role from accounts that do not require asset-compilation permissions
Rotate APP_KEY, database credentials, and any other secrets stored in .env if compromise cannot be ruled out
Review stored values in Brand Settings, Editor Settings, and Mail Brand Settings for injected @import directives

Patch Information

The fix is delivered in Winter CMS 1.2.13. The Winter Storm patch adds a setAllowedImportRoots() API to LessCompiler and a new LessImportResolver class. Backend models BrandSetting.php and EditorSetting.php were updated to configure the resolver before invoking Less_Parser. See the GitHub Security Advisory GHSA-58fp-mcx6-7qf9 and Winter CMS v1.2.13 release notes.

Workarounds

Restrict the Developer role to trusted administrators until the upgrade to 1.2.13 is completed
Remove the permissions backend.manage_branding, backend.manage_editor, and cms.manage_themes from non-essential backend accounts
Place the application .env file outside the web process's readable path where the deployment layout allows, reducing the value of a successful read primitive

bash

# Upgrade Winter CMS via Composer to the patched version
composer require winter/wn-system:^1.2.13
php artisan winter:up
php artisan cache:clear