CVE-2026-125340 Winter CMS: Reflected XSS through the search query parameter in the backend Table widget
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-125340?
CVE-2026-125340 is a medium-severity vulnerability in wintercms winter, published on 10 Nov 2026.
Official description
Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.420 until 1.2.14, the backend Table widget partial modules/backend/widgets/table/partials/_table.php emits the search query parameter without HTML encoding inside a script template. A script-closing sequence in a crafted top-level GET URL terminates the raw-text template and causes the remaining input to be parsed as backend markup, even when the widget uses searching: false. Any Table or DataTable page is a sink, including the core Editor Settings route /backend/system/settings/update/winter/backend/editor, and an unauthenticated attacker can induce an authorized backend user to follow the link. Script executing in the victim's backend origin can read the CSRF token and issue credentialed requests with that user's permissions. For the core sink, a victim with backend.manage_editor, normally a Developer-role user or superuser, can edit CMS templates, so the injected script can conditionally chain to server-side code execution; this does not grant permissions the victim lacks and does not apply automatically to every third-party plugin sink. This issue is fixed in version 1.2.14.
Weakness: CWE-79
Which versions are affected by CVE-2026-125340?
1 open source package ship an affected version, including winter/wn-backend-module.
| Package | Affected | Fixed in |
|---|---|---|
winter/wn-backend-module Packagist | From 1.0.420 | 1.2.14 |
How do I fix CVE-2026-125340?
Upgrade winter/wn-backend-module to 1.2.14 or later.
Is CVE-2026-125340 being exploited?
There is no known exploitation of CVE-2026-125340 in the wild and no public exploit code.
Sources
Also known as GHSA-hq84-x37p-j6q5.