Elmahy111

**Name of the Vulnerable Software and Affected Versions** Winter CMS versions prior to 1.2.13 **Description** A local file inclusion issue exists in the JavascriptImporter filter. Authenticated users with `cms.manage assets` permission can disclose arbitrary server-readable files, such as the `.env` file located outside the theme directory, by inserting `=include` or `=require` directives into theme JavaScript assets. The combined output is then served through the `combine` route, making sensitive information like application keys and database credentials accessible to unauthenticated visitors. **Recommendations** Update Winter CMS to version 1.2.13 or later.