CVE-2026-63179

Name of the Vulnerable Software and Affected Versions Winter CMS versions prior to 1.2.13

Description Authenticated backend users can disclose arbitrary files readable by the PHP process by injecting @import (inline) directives into LESS source that the backend compiles. This occurs because the LESS parser was instantiated without a safe import resolver, allowing absolute paths and directory traversal via .. to access files outside the intended directory, such as the .env file containing the APP KEY and database credentials. The issue is reachable through four entry points:

Exploitation requires a backend account with specific permissions, which are assigned by default to the Developer role.

Recommendations Update Winter CMS to version 1.2.13. As a temporary mitigation, remove the cms.manage assets permission from any non-trusted roles and clear all values from the Brand Settings custom css and Editor Settings html custom styles fields.