CVE-2026-125340

Name of the Vulnerable Software and Affected Versions Winter CMS versions 1.0.420 through 1.2.13

Description Winter CMS fails to HTML-encode the search query parameter within the backend Table widget partial located at modules/backend/widgets/table/partials/ table.php. Because this value is emitted inside a <script type="text/template"> block, an attacker can use a script-closing sequence in a crafted GET URL to terminate the template and inject arbitrary backend markup. This issue affects any page rendering a Table or DataTable widget, including the core Editor Settings endpoint /backend/system/settings/update/winter/backend/editor.

An unauthenticated attacker can induce an authorized backend user to follow a malicious link, executing scripts in the victim's authenticated backend origin. This allows the attacker to read the CSRF token and perform credentialed requests. For users with backend.manage editor permissions, such as those with the Developer role or superusers, this can lead to server-side code execution by editing CMS templates.

Recommendations Update Winter CMS to version 1.2.14. As a temporary workaround, manually edit modules/backend/widgets/table/partials/ table.php and change value="<?= get('search') ?>" to value="<?= e(get('search')); ?>".