CVE-2023-52085 Winter CMS Local File Inclusion through Server Side Template Injection
Attackers with backend form access can exploit a Local File Inclusion vulnerability in Winter CMS to read arbitrary files from the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52085?
CVE-2023-52085 is a low-severity path traversal vulnerability in wintercms winter, published on 29 Dec 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.
Weakness: CWE-22
Which versions are affected by CVE-2023-52085?
2 open source packages ship an affected version, including winter/wn-backend-module. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
winter/wn-backend-module Packagist | All versions | 1.2.4 |
winter/wn-backend-module Packagist | All versions | 1.2.4 |
Products include Wintercms Winter.
How do I fix CVE-2023-52085?
Upgrade winter/wn-backend-module to 1.2.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-52085 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-52085 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in wintercms winter
- CVE-2026-27591 Winter: Privilege escalation by authenticated backend users
- CVE-2024-54149 Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion
- CVE-2022-39357 Winter vulnerable to Prototype Pollution in Snowboard framework
- CVE-2024-29686 Winter CMS Server-Side Template Injection (SSTI) vulnerability
- CVE-2023-52083 Stored XSS through privileged upload of Media Manager file followed by renaming
Sources
Also known as GHSA-2x7r-93ww-cxrq.