CVE-2026-125341
LOW
INFO
Priority: 0.01
BB Relevance:
29/100
Published: 2026-11-10
Modified: 2026-11-12
First seen: 2026-11-10
Status: active
Attack Surface
Network
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
High
UI:
Required
S:
Unchanged
C:
None
I:
Low
A:
None
Description
Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\Widgets\Lists::evalImageTypeValue() interpolates the result of ImageResizer::filterGetUrl() into a single-quoted image source attribute without escaping it. In a third-party plugin that renders an attacker-influenced value through an image list column, an unsupported image value is returned verbatim, can break out of the attribute, and can inject event handlers that execute when a backend user views the list. Winter core ships no image list column, so a default installation is unaffected. This issue is fixed in version 1.2.14.