CVE-2026-125338
MEDIUM
MEDIUM
Priority: 0.02
BB Relevance:
44/100
Published: 2026-11-10
Modified: 2026-11-14
First seen: 2026-11-10
Status: active
Attack Surface
Network
Low Complexity
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
High
UI:
Required
S:
Unchanged
C:
None
I:
High
A:
None
Description
Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, BrandSetting::renderCss() and EditorSetting::renderCss() store raw LESS compiler output with Cache::forever() but apply strip_tags() only to the value returned on a cache miss. The first render after saving custom CSS appears sanitized while priming an unsafe cache entry, and later cache hits return unsanitized output into the backend style element, allowing a user with backend.manage_branding or backend.manage_editor to cause stored cross-site scripting when another backend page renders the styles. The styles also appear on unauthenticated backend sign-in, password restore, and password reset layouts. This issue is fixed in version 1.2.14.