CVE-2026-125338 Winter CMS: Stored XSS through cached Brand Settings and Editor Settings custom styles
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-125338?
CVE-2026-125338 is a medium-severity vulnerability in wintercms winter, published on 10 Nov 2026.
Official description
Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, BrandSetting::renderCss() and EditorSetting::renderCss() store raw LESS compiler output with Cache::forever() but apply strip_tags() only to the value returned on a cache miss. The first render after saving custom CSS appears sanitized while priming an unsafe cache entry, and later cache hits return unsanitized output into the backend style element, allowing a user with backend.manage_branding or backend.manage_editor to cause stored cross-site scripting when another backend page renders the styles. The styles also appear on unauthenticated backend sign-in, password restore, and password reset layouts. This issue is fixed in version 1.2.14.
Weakness: CWE-79
Which versions are affected by CVE-2026-125338?
1 open source package ship an affected version, including winter/wn-backend-module.
| Package | Affected | Fixed in |
|---|---|---|
winter/wn-backend-module Packagist | All versions | 1.2.14 |
How do I fix CVE-2026-125338?
Upgrade winter/wn-backend-module to 1.2.14 or later.
Is CVE-2026-125338 being exploited?
There is no known exploitation of CVE-2026-125338 in the wild and no public exploit code.
Sources
Also known as GHSA-5cwr-5jxg-pcf6.