CVE-2026-125341

Name of the Vulnerable Software and Affected Versions Winter CMS versions 1.1.0 through 1.2.13

Description The evalImageTypeValue() function in BackendWidgetsLists interpolates the result of ImageResizer::filterGetUrl() into a single-quoted image source attribute without proper escaping. When a third-party plugin renders an attacker-influenced value through an image list column, an unsupported image value is returned verbatim. This allows an attacker to break out of the attribute and inject arbitrary attributes, such as event handlers, which execute in the session of the backend user viewing the list. A default installation is unaffected as the core does not ship with an image list column; exploitation requires a plugin that renders attacker-influenced values through one.

Recommendations Update Winter CMS to version 1.2.14. As a temporary workaround, manually apply the security commit to modules/backend/widgets/Lists.php.