CVE-2026-125341 Winter CMS: Stored XSS through Backend List widget image columns
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-125341?
CVE-2026-125341 is a low-severity vulnerability in wintercms winter, published on 10 Nov 2026.
Official description
Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\Widgets\Lists::evalImageTypeValue() interpolates the result of ImageResizer::filterGetUrl() into a single-quoted image source attribute without escaping it. In a third-party plugin that renders an attacker-influenced value through an image list column, an unsupported image value is returned verbatim, can break out of the attribute, and can inject event handlers that execute when a backend user views the list. Winter core ships no image list column, so a default installation is unaffected. This issue is fixed in version 1.2.14.
Weakness: CWE-79
Which versions are affected by CVE-2026-125341?
1 open source package ship an affected version, including winter/wn-backend-module.
| Package | Affected | Fixed in |
|---|---|---|
winter/wn-backend-module Packagist | From 1.1.0 | 1.2.14 |
How do I fix CVE-2026-125341?
Upgrade winter/wn-backend-module to 1.2.14 or later.
Is CVE-2026-125341 being exploited?
There is no known exploitation of CVE-2026-125341 in the wild and no public exploit code.
Sources
Also known as GHSA-7mpf-4465-7fc2.