CVE-2026-79773

Name of the Vulnerable Software and Affected Versions Winter CMS versions prior to 1.2.13

Description A local file inclusion issue exists in the JavascriptImporter filter. Authenticated users with cms.manage assets permission can disclose arbitrary server-readable files, such as the .env file located outside the theme directory, by inserting =include or =require directives into theme JavaScript assets. The combined output is then served through the combine route, making sensitive information like application keys and database credentials accessible to unauthenticated visitors.

Recommendations Update Winter CMS to version 1.2.13 or later.