CVE-2026-79774: Winter CMS Twig Sandbox Bypass Vulnerability

CVE-2026-79774 Overview

CVE-2026-79774 is a Twig sandbox escape vulnerability in Winter CMS versions before 1.2.13. The flaw resides in System\Twig\SecurityPolicy and results from an incomplete fix for a prior sandbox bypass. Authenticated backend users with template-editing permissions can forward method calls through Eloquent models and query builders using methods such as saveQuietly(), deleteQuietly(), increment(), decrement(), and newQuery(). Exploitation allows reading and modifying arbitrary database records, executing arbitrary SQL, and achieving remote code execution by injecting PHP into template code sections. The vulnerability is categorized under [CWE-693] Protection Mechanism Failure.

Critical Impact
Authenticated backend users with template-editing rights can escape the Twig sandbox to achieve arbitrary SQL execution and remote code execution on the host application.

Affected Products

Winter CMS versions prior to 1.2.13
System\Twig\SecurityPolicy component
modules/system/classes/MarkupManager.php markup handling

Discovery Timeline

2026-08-25 - CVE-2026-79774 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79774

Vulnerability Analysis

Winter CMS relies on the Twig sandbox to constrain what backend template authors can invoke at render time. The System\Twig\SecurityPolicy class enforces an allowlist of methods callable on objects exposed to templates. The prior fix restricted several direct method calls but did not account for method forwarding used by Laravel's Eloquent models and query builders.

When a template accesses an attribute on an Eloquent model, the model's __call magic method forwards unknown calls to an underlying query builder or collection. Methods such as saveQuietly(), deleteQuietly(), increment(), decrement(), and newQuery() bypass sandbox checks because they are resolved dynamically rather than as direct class methods. This lets an attacker interact with the underlying database layer from within an otherwise restricted template context.

Once database write access is available, an attacker can modify records that Winter CMS reads to reconstruct executable PHP, including template code sections stored in the CMS database. Injected PHP is executed by the application, yielding remote code execution under the web server user.

Root Cause

The root cause is an incomplete allowlist in System\Twig\SecurityPolicy. The policy inspects direct method names but does not resolve calls forwarded through __call on Eloquent objects. This gap enables sandbox-restricted callers to reach unsafe query and persistence methods that were never intended to be exposed to template authors.

Attack Vector

Exploitation requires an authenticated backend account that holds template-editing permissions. The attacker crafts a Twig template that resolves an object attribute chain terminating in a forwarded method call such as newQuery() or deleteQuietly(). Rendering the template in the backend triggers the forwarded call. The attacker chains database writes to persist PHP code into a CMS template code block, achieving code execution on the next render.

php

// Security patch: modules/system/classes/MarkupManager.php
 <?php namespace System\Classes;
 
 use System\Twig\Extension as SystemTwigExtension;
+use System\Twig\GetAttrAdjuster;
 use System\Twig\Loader as SystemTwigLoader;
 use System\Twig\SecurityPolicy as TwigSecurityPolicy;
 use Twig\Environment as TwigEnvironment;

// New file: modules/system/twig/GetAttrAdjuster.php
// Swaps every GetAttrExpression node for a custom GetAttrNode so that
// method calls in sandbox mode route through
// SecurityPolicy::castMethodObjectToSafeObject, enabling SafeCollection /
// SafePaginator protections.
class GetAttrAdjuster implements NodeVisitorInterface
{
    public function enterNode(Node $node, Environment $env): Node
    {
        if (get_class($node) !== GetAttrExpression::class) {
            return $node;
        }
        // ...replacement logic...
    }
}
// Source: https://github.com/wintercms/winter/commit/725bbcda232466f7f71381c271c6916573d576e6

Detection Methods for CVE-2026-79774

Indicators of Compromise

Backend audit-log entries showing template edits containing Twig attribute chains that reference newQuery, saveQuietly, deleteQuietly, increment, or decrement.
Unexpected modifications to CMS template code sections, layouts, or partials persisted through backend accounts.
Database write activity originating from template render requests rather than administrative endpoints.
New or modified rows in Winter CMS content tables outside normal editorial workflows.

Detection Strategies

Review backend user activity for template edits that reference Eloquent forwarding methods within Twig expressions.
Monitor web server processes for PHP execution paths spawned during template rendering, such as unexpected sh, bash, or outbound network calls from the PHP-FPM worker.
Compare deployed template files and CMS content tables against version control or last known-good backups to detect drift.

Monitoring Recommendations

Enable verbose logging of Winter CMS backend template edits and export logs to a central SIEM.
Alert on backend accounts that gain or use access_cms_templates or equivalent template-editing permissions.
Track HTTP request volume and response anomalies against /backend/cms/* routes for signs of exploitation attempts.

How to Mitigate CVE-2026-79774

Immediate Actions Required

Upgrade Winter CMS to version 1.2.13 or later, which introduces the GetAttrAdjuster node visitor and hardened SecurityPolicy handling.
Audit all backend accounts with template-editing permissions and remove access for users who do not require it.
Rotate credentials for backend administrators and review recent template and content changes for injected PHP.
Restrict backend network access to trusted IP ranges or VPN-only routes.

Patch Information

The fix is delivered in Winter CMS 1.2.13 via commit 725bbcda232466f7f71381c271c6916573d576e6. The patch adds System\Twig\GetAttrAdjuster, which rewrites GetAttrExpression nodes to a custom GetAttrNode that routes method calls through SecurityPolicy::castMethodObjectToSafeObject. This activates SafeCollection and SafePaginator wrappers so that forwarded Eloquent methods are subject to sandbox checks. See the GitHub Security Advisory GHSA-8cfw-pcwh-v63w and the VulnCheck Advisory for advisory details.

Workarounds

If patching is not immediately possible, revoke template-editing permissions from all non-essential backend users.
Place the Winter CMS backend behind additional authentication such as a reverse proxy with mutual TLS or SSO enforcement.
Enable file integrity monitoring on CMS template directories and database tables that store template code sections.

bash

# Upgrade Winter CMS via Composer to the patched release
composer require wintercms/winter:^1.2.13
php artisan winter:up
php artisan cache:clear