CVE-2026-79774: Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy
Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent models and query builders using methods like saveQuietly(), deleteQuietly(), increment(), decrement(), and newQuery() to read and modify arbitrary database records, execute arbitrary SQL, and achieve remote code execution by injecting PHP into template code sections.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Winter CMSto a version that resolves this vulnerability.Fixed in 1.2.13 - Compensating control
Restrict access to backend users who have template-editing permissions, since the Twig sandbox escape in System\Twig\SecurityPolicy affects authenticated backend users with template-editing rights.
Event History
Frequently Asked Questions
Which users could exploit this issue?
An attacker must be an authenticated Winter CMS backend user with permission to edit templates. The available information does not indicate that unauthenticated users can exploit it.
Which installations should be considered vulnerable?
Winter CMS installations running versions before 1.2.13 should be considered affected. The issue is reachable where a backend user has template-editing permissions.
What level of impact could successful exploitation have?
A successful attacker can bypass Twig sandbox restrictions to read and modify arbitrary database records and execute arbitrary SQL. Injecting PHP into template code sections can lead to remote code execution.