CVE-2026-79773: Winter CMS Path Traversal Vulnerability

CVE-2026-79773 Overview

CVE-2026-79773 is a Local File Inclusion (LFI) vulnerability in Winter CMS versions before 1.2.13. The flaw exists in the JavascriptImporter filter, which processes =include and =require directives inside theme JavaScript assets. Authenticated users holding the cms.manage_assets permission can reference arbitrary server-readable files outside the theme directory. The combined asset output is served through the public combine route, making the disclosed content readable by unauthenticated visitors. Attackers can retrieve sensitive files such as .env, exposing application keys and database credentials. The issue is tracked under [CWE-22] Path Traversal.

Critical Impact
Authenticated CMS asset managers can exfiltrate .env files, application keys, and database credentials by injecting =include directives into theme JavaScript.

Affected Products

Winter CMS versions prior to 1.2.13
Winter CMS cms module (JavascriptImporter filter)
Deployments exposing the public combine asset route

Discovery Timeline

2026-08-25 - CVE-2026-79773 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-79773

Vulnerability Analysis

Winter CMS bundles a JavascriptImporter filter that supports =include and =require directives inside theme JavaScript assets. The filter resolves paths without confining them to the theme's asset root. An authenticated user with the cms.manage_assets permission can author a JavaScript file that references arbitrary paths on the host filesystem.

When the CMS combines these assets, the JavascriptImporter reads the referenced file content and embeds it into the combined output. The combined bundle is served through the public combine route without authentication. As a result, any file readable by the web server process, including .env, config/*.php, or credential material, can be leaked to unauthenticated visitors.

The permission model treated cms.manage_assets as a low-risk operational grant. In practice, the permission conveys code-adjacent privilege because assets flow through server-side transformation before public delivery.

Root Cause

The root cause is missing path confinement in the asset combiner. The =include and =require directive handler did not validate that referenced files lived within an approved theme root. This design flaw is classified as [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

An attacker authenticates to the Winter CMS backend with an account holding cms.manage_assets. The attacker edits or creates a theme JavaScript asset and inserts an =include directive pointing to a target file, for example ../../../../.env. The attacker then requests the public combine URL for that asset. The response body contains the contents of the target file.

php

// Security patch: modules/cms/lang/en/lang.php
// Adds guidance clarifying that cms.manage_assets is a trust-sensitive permission
'permissions' => [
    'name' => 'CMS',
    'manage_content' => 'Manage website content files',
    'manage_content_comment' => 'This permission should only be given to trusted users, as it allows direct access to the theme\'s content files.',
    'manage_assets' => 'Manage website assets - images, JavaScript files, CSS files',
    'manage_assets_comment' => 'This permission should only be given to trusted users, as it allows direct access to the theme\'s asset files, which are combined and served publicly.',
    'manage_pages' => 'Create, modify and delete website pages',
],

Source: GitHub Commit e09c8d3. The upstream fix confines asset combiner imports to allowed roots and documents the trust boundary of the affected permissions.

Detection Methods for CVE-2026-79773

Indicators of Compromise

Theme JavaScript files containing =include or =require directives with relative traversal sequences such as ../ or absolute paths referencing .env, config/, or storage/.
Unexpected modifications to files under themes/*/assets/js/ by accounts other than the primary developer.
Requests to the Winter CMS combine route returning payloads that contain environment variable syntax (APP_KEY=, DB_PASSWORD=) instead of JavaScript.
Backend audit records showing asset edits by non-developer accounts shortly before anomalous combine traffic.

Detection Strategies

Grep theme asset directories for =include and =require tokens paired with path traversal patterns or references outside the theme root.
Inspect HTTP responses from the combine route for non-JavaScript signatures, including PHP tags, INI-style key/value pairs, and credential-shaped strings.
Correlate Winter CMS backend authentication logs with asset modification events and subsequent unauthenticated hits to the same combined bundle URL.

Monitoring Recommendations

Alert on any write to themes/*/assets/**/*.js outside a change management window.
Baseline the size and content type of responses from the combine endpoint; flag responses exceeding baseline or containing secret patterns.
Monitor for privilege assignments granting cms.manage_assets to non-developer roles.

How to Mitigate CVE-2026-79773

Immediate Actions Required

Upgrade Winter CMS to version 1.2.13 or later, which confines JavascriptImporter includes to approved roots.
Rotate any secrets that were present in .env, including APP_KEY, database credentials, mail credentials, and third-party API tokens.
Audit accounts holding cms.manage_assets and revoke the permission from users who are not trusted developers.
Review theme JavaScript assets for existing =include or =require directives that reference files outside the theme.

Patch Information

The fix ships in Winter CMS 1.2.13. The relevant commits are GitHub Commit e09c8d3 and GitHub Commit fd673f4. Additional context is available in the GitHub Security Advisory GHSA-2223 and the VulnCheck Local File Inclusion Advisory.

Workarounds

Restrict the cms.manage_assets permission to developer-tier accounts protected with strong authentication and MFA.
Move sensitive configuration outside the web server user's read scope where possible, and load secrets through a runtime secret manager.
Place a web application firewall rule that blocks combine responses containing credential patterns such as APP_KEY= or DB_PASSWORD=.
Enforce filesystem permissions so the web server process cannot read files outside the application document root and required runtime directories.

bash

# Upgrade Winter CMS to the patched release
composer require winter/winter:^1.2.13
php artisan winter:up

# Audit theme JavaScript for dangerous importer directives
grep -RnE '=(include|require)\s+[^\s]*(\.\./|/etc/|\.env)' themes/

# Restrict .env readability to the application user only
chmod 600 .env