CVE-2026-79774

Name of the Vulnerable Software and Affected Versions Winter CMS versions prior to 1.2.13

Description An incomplete fix in SystemTwigSecurityPolicy allows authenticated backend users with template-editing permissions to bypass Twig sandbox restrictions. This is achieved through method forwarding via Eloquent models and query builders using functions such as saveQuietly(), deleteQuietly(), increment(), decrement(), and newQuery(). Successful exploitation enables attackers to read and modify arbitrary database records, execute arbitrary SQL, and achieve remote code execution by injecting PHP into template code sections.

Recommendations Update Winter CMS to version 1.2.13 or later.