CVE-2026-79773: Winter CMS before 1.2.13 Local File Inclusion via JavaScript
Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manageassets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can reference files like .env outside the theme directory, and the combined output served through the combine route becomes readable by unauthenticated visitors, exposing application keys and database credentials.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated Winter CMS user with the cms.manage_assets permission can exploit it. The disclosed content can then be retrieved by unauthenticated visitors through the combine route.
What access and conditions are required for exploitation?
The attacker needs an account with cms.manage_assets permission and the ability to place =include or =require directives in a theme JavaScript asset. They can use those directives to reference server-readable files outside the theme directory.
What is the impact if exploitation succeeds?
An attacker can disclose arbitrary files that the server process can read, including files such as .env. Exposed data may include application keys and database credentials.
How can defenders identify possible exploitation?
Review theme JavaScript assets for =include or =require directives, particularly directives referencing paths outside the theme directory. Also assess whether combined JavaScript output available through the combine route contains unexpected file content or sensitive configuration values.