« Volver al listado

CVE-2026-22254

Estado: AnalizadaBaja (3.5)—

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: cms.manage_assets. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general. This vulnerability is fixed in 1.2.10.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Wintercms — Winter

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-22254",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-22254",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-09T15:19:27.066356Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 0,
          "attackVector": "NETWORK",
          "baseSeverity": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 0,
        "exploitabilityScore": 0.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.5,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "wintercms",
          "product": "winter",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.2.10"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-06T20:16:10.057",
  "references": [
    {
      "url": "https://github.com/wintercms/winter/commit/8a7f74b004fcd19721764fc63af0cdb339d9fb65",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/wintercms/winter/releases/tag/v1.2.10",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/wintercms/winter/security/advisories/GHSA-m7gw-rffq-rxjm",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would need access to the Backend with a user account with the following permission: cms.manage_assets. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general. This vulnerability is fixed in 1.2.10."
    },
    {
      "lang": "es",
      "value": "Winter es un sistema de gestión de contenido (CMS) gratuito y de código abierto basado en el framework PHP Laravel. Las versiones de Winter CMS anteriores a la 1.2.10 permitían a los usuarios con acceso al Gestor de Activos del CMS subir SVGs sin sanitización automática. Para explotar activamente este problema de seguridad, un atacante necesitaría acceso al Backend con una cuenta de usuario con el siguiente permiso: cms.manage_assets. Los mantenedores de Winter CMS recomiendan encarecidamente que el permiso cms.manage_assets solo se reserve a administradores y desarrolladores de confianza en general. Esta vulnerabilidad está corregida en la 1.2.10."
    }
  ],
  "lastModified": "2026-06-17T10:19:38.580",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wintercms:winter:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "588A92F0-EBF4-4A9A-A0A3-8BD4F9FDA03F",
              "versionEndExcluding": "1.2.10"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}