CVE-2026-125341
Winter CMS: Stored XSS through Backend List widget image columns
Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\Widgets\Lists::evalImageTypeValue() interpolates the result of ImageResizer::filterGetUrl() into a single-quoted image source attribute without escaping it. In a third-party plugin that renders an attacker-influenced value through an image list column, an unsupported image value is returned verbatim, can break out of the attribute, and can inject event handlers that execute when a backend user views the list. Winter core ships no image list column, so a default installation is unaffected. This issue is fixed in version 1.2.14.
| CWE | CWE-79 |
| Vendor | wintercms |
| Product | winter |
| Published | Nov 10, 2026 |
| Last Updated | Nov 10, 2026 |
Get instant alerts for wintercms winter
Be the first to know when new low vulnerabilities affecting wintercms winter are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N