CVE-2026-125339 Winter CMS: CSRF through AJAX handler names reachable as backend page actions
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-125339?
CVE-2026-125339 is a medium-severity vulnerability in wintercms winter, published on 10 Nov 2026.
Official description
Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\Classes\Controller::actionExists() accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing backend AJAX handlers without a CSRF token. Because backend routes use Route::any, CSRF validation skips GET, and the default SameSite=Lax session cookie is sent on cross-site navigation, an unauthenticated attacker can induce an authorized backend user to follow a link such as /backend/system/eventlogs/index_onEmptyLog. Affected handlers in the backend, CMS, and system modules can truncate logs, reset settings, alter backend user state, or delete CMS templates, while URL path segments can select a target record. This issue is fixed in version 1.2.14.
Weakness: CWE-352
Which versions are affected by CVE-2026-125339?
1 open source package ship an affected version, including winter/wn-backend-module.
| Package | Affected | Fixed in |
|---|---|---|
winter/wn-backend-module Packagist | From 1.0.319 | 1.2.14 |
How do I fix CVE-2026-125339?
Upgrade winter/wn-backend-module to 1.2.14 or later.
Is CVE-2026-125339 being exploited?
There is no known exploitation of CVE-2026-125339 in the wild and no public exploit code.
Sources
Also known as GHSA-p2ch-c2c3-4xm5.