CVE-2026-125337 Winter CMS: ImportExportController AJAX handlers bypass granular import/export permission gate
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-125337?
CVE-2026-125337 is a high-severity vulnerability in wintercms winter, published on 10 Nov 2026.
Official description
Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, the ImportExportController behavior applies userHasAccess() only to the import() and export() page actions, while Backend\Classes\Controller::execAjaxHandlers() dispatches onImport(), onImportLoadForm(), onImportLoadColumnSampleForm(), onExport(), and onExportLoadForm() before those gated actions run, and the separately reachable download() action also lacks the granular export check. An authenticated backend user with a valid session and coarse access through $requiredPermissions, but without the configured import[permissions] or export[permissions], can use the import handlers to write or overwrite records and can use onExport() followed by download() to retrieve the complete dataset exposed by the export model. Controllers without granular permission keys are unaffected because userHasAccess() is intentionally default-permissive. This issue is fixed in version 1.2.14.
Which versions are affected by CVE-2026-125337?
1 open source package ship an affected version, including winter/wn-backend-module.
| Package | Affected | Fixed in |
|---|---|---|
winter/wn-backend-module Packagist | All versions | 1.2.14 |
How do I fix CVE-2026-125337?
Upgrade winter/wn-backend-module to 1.2.14 or later.
Is CVE-2026-125337 being exploited?
There is no known exploitation of CVE-2026-125337 in the wild and no public exploit code.
Sources
Also known as GHSA-fm29-4mq3-phg6.