{"answers":{"affected":"1 open source package ship an affected version, including winter/wn-backend-module.","exploited":"There is no known exploitation of CVE-2026-125337 in the wild and no public exploit code.","exposure":"","fix":"Upgrade winter/wn-backend-module to 1.2.14 or later.","what":"CVE-2026-125337 is a high-severity vulnerability in wintercms winter, published on 10 Nov 2026."},"fix_prompt":"Check this codebase for CVE-2026-125337 and fix it if it is affected.\n\nWhat it is: CVE-2026-125337 is a high-severity vulnerability in wintercms winter, published on 10 Nov 2026. \nExploitation: There is no known exploitation of CVE-2026-125337 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- winter/wn-backend-module (Packagist): affected all versions; fixed in 1.2.14\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-125337/ (Markdown: https://insights.sbomify.com/CVE-2026-125337/index.md)","id":"CVE-2026-125337","markdown":"https://insights.sbomify.com/CVE-2026-125337/index.md","name":"CVE-2026-125337","record":{"aliases":["GHSA-fm29-4mq3-phg6"],"analysis":null,"analysis_generated_by":null,"assigner":"GitHub_M","cpe":[],"cvss":{"score":8.3,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"},{"id":"CWE-862","name":"Missing Authorization"}],"description":"Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, the ImportExportController behavior applies userHasAccess() only to the import() and export() page actions, while Backend\\Classes\\Controller::execAjaxHandlers() dispatches onImport(), onImportLoadForm(), onImportLoadColumnSampleForm(), onExport(), and onExportLoadForm() before those gated actions run, and the separately reachable download() action also lacks the granular export check. An authenticated backend user with a valid session and coarse access through $requiredPermissions, but without the configured import[permissions] or export[permissions], can use the import handlers to write or overwrite records and can use onExport() followed by download() to retrieve the complete dataset exposed by the export model. Controllers without granular permission keys are unaffected because userHasAccess() is intentionally default-permissive. This issue is fixed in version 1.2.14.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Winter CMS: ImportExportController AJAX handlers bypass granular import/export permission gate","id":"CVE-2026-125337","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":3,"next":{"headline":"Winter CMS: Stored XSS through cached Brand Settings and Editor Settings custom styles","id":"CVE-2026-125338"},"nickname":null,"packages":[{"ecosystem":"Packagist","fixed":["1.2.14"],"introduced":["0"],"last_affected":[],"package":"winter/wn-backend-module","purl":null,"source":"GHSA-fm29-4mq3-phg6"}],"prev":{"headline":"Forge: X.509 nameConstraints not enforced by verifyCertificateChain()","id":"CVE-2026-125336"},"products":["winter"],"published":"2026-11-10","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-11-10","vendors":["wintercms"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-125337/"}