{"answers":{"affected":"1 open source package ship an affected version, including winter/wn-backend-module.","exploited":"There is no known exploitation of CVE-2026-125340 in the wild and no public exploit code.","exposure":"","fix":"Upgrade winter/wn-backend-module to 1.2.14 or later.","what":"CVE-2026-125340 is a medium-severity vulnerability in wintercms winter, published on 10 Nov 2026."},"fix_prompt":"Check this codebase for CVE-2026-125340 and fix it if it is affected.\n\nWhat it is: CVE-2026-125340 is a medium-severity vulnerability in wintercms winter, published on 10 Nov 2026. \nExploitation: There is no known exploitation of CVE-2026-125340 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- winter/wn-backend-module (Packagist): affected from 1.0.420; fixed in 1.2.14\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-125340/ (Markdown: https://insights.sbomify.com/CVE-2026-125340/index.md)","id":"CVE-2026-125340","markdown":"https://insights.sbomify.com/CVE-2026-125340/index.md","name":"CVE-2026-125340","record":{"aliases":["GHSA-hq84-x37p-j6q5"],"analysis":null,"analysis_generated_by":null,"assigner":"GitHub_M","cpe":[],"cvss":{"score":4.5,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"description":"Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.420 until 1.2.14, the backend Table widget partial modules/backend/widgets/table/partials/_table.php emits the search query parameter without HTML encoding inside a script template. A script-closing sequence in a crafted top-level GET URL terminates the raw-text template and causes the remaining input to be parsed as backend markup, even when the widget uses searching: false. Any Table or DataTable page is a sink, including the core Editor Settings route /backend/system/settings/update/winter/backend/editor, and an unauthenticated attacker can induce an authorized backend user to follow the link. Script executing in the victim's backend origin can read the CSRF token and issue credentialed requests with that user's permissions. For the core sink, a victim with backend.manage_editor, normally a Developer-role user or superuser, can edit CMS templates, so the injected script can conditionally chain to server-side code execution; this does not grant permissions the victim lacks and does not apply automatically to every third-party plugin sink. This issue is fixed in version 1.2.14.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Winter CMS: Reflected XSS through the search query parameter in the backend Table widget","id":"CVE-2026-125340","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":3,"next":{"headline":"Winter CMS: Stored XSS through Backend List widget image columns","id":"CVE-2026-125341"},"nickname":null,"packages":[{"ecosystem":"Packagist","fixed":["1.2.14"],"introduced":["1.0.420"],"last_affected":[],"package":"winter/wn-backend-module","purl":null,"source":"GHSA-hq84-x37p-j6q5"}],"prev":{"headline":"Winter CMS: CSRF through AJAX handler names reachable as backend page actions","id":"CVE-2026-125339"},"products":["winter"],"published":"2026-11-10","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-11-10","vendors":["wintercms"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-125340/"}