Unknown · Winter Cms · CVE-2026-79774
**Name of the Vulnerable Software and Affected Versions**
Winter CMS versions prior to 1.2.13
**Description**
An incomplete fix in `SystemTwigSecurityPolicy` allows authenticated backend users with template-editing permissions to bypass Twig sandbox restrictions. This is achieved through method forwarding via Eloquent models and query builders using functions such as `saveQuietly()`, `deleteQuietly()`, `increment()`, `decrement()`, and `newQuery()`. Successful exploitation enables attackers to read and modify arbitrary database records, execute arbitrary SQL, and achieve remote code execution by injecting PHP into template code sections.
**Recommendations**
Update Winter CMS to version 1.2.13 or later.