{"affected":[{"product":"winter","source":"CNA: GitHub_M","vendor":"wintercms","versions":[{"status":"affected","version":">= 1.0.319, < 1.2.14"}]},{"defaultStatus":"unaffected","ecosystem":"Packagist","packageName":"winter/wn-backend-module","product":"winter/wn-backend-module","source":"OSV GHSA-p2ch-c2c3-4xm5","vendor":"","versions":[{"status":"affected","version":"v1.0.473","versionType":"Packagist"},{"status":"affected","version":"v1.0.474","versionType":"Packagist"},{"status":"affected","version":"v1.0.475","versionType":"Packagist"},{"status":"affected","version":"v1.1.10","versionType":"Packagist"},{"status":"affected","version":"v1.1.11","versionType":"Packagist"},{"status":"affected","version":"v1.1.2","versionType":"Packagist"},{"status":"affected","version":"v1.1.3","versionType":"Packagist"},{"status":"affected","version":"v1.1.4","versionType":"Packagist"},{"status":"affected","version":"v1.1.5","versionType":"Packagist"},{"status":"affected","version":"v1.1.6","versionType":"Packagist"},{"status":"affected","version":"v1.1.7","versionType":"Packagist"},{"status":"affected","version":"v1.1.8","versionType":"Packagist"},{"status":"affected","version":"v1.1.9","versionType":"Packagist"},{"status":"affected","version":"v1.2.0","versionType":"Packagist"},{"status":"affected","version":"v1.2.1","versionType":"Packagist"},{"status":"affected","version":"v1.2.10","versionType":"Packagist"},{"status":"affected","version":"v1.2.11","versionType":"Packagist"},{"status":"affected","version":"v1.2.12","versionType":"Packagist"},{"status":"affected","version":"v1.2.13","versionType":"Packagist"},{"status":"affected","version":"v1.2.2","versionType":"Packagist"},{"status":"affected","version":"v1.2.3","versionType":"Packagist"},{"status":"affected","version":"v1.2.4","versionType":"Packagist"},{"status":"affected","version":"v1.2.5","versionType":"Packagist"},{"status":"affected","version":"v1.2.6","versionType":"Packagist"},{"status":"affected","version":"v1.2.7","versionType":"Packagist"},{"status":"affected","version":"v1.2.8","versionType":"Packagist"},{"status":"affected","version":"v1.2.9","versionType":"Packagist"},{"events":[{"introduced":"1.0.319"},{"fixed":"1.2.14"}],"status":"unknown","version":"1.0.319","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-125339","cwes":["CWE-352"],"description":"Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\\Classes\\Controller::actionExists() accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing backend AJAX handlers without a CSRF token. Because backend routes use Route::any, CSRF validation skips GET, and the default SameSite=Lax session cookie is sent on cross-site navigation, an unauthenticated attacker can induce an authorized backend user to follow a link such as /backend/system/eventlogs/index_onEmptyLog. Affected handlers in the backend, CMS, and system modules can truncate logs, reset settings, alter backend user state, or delete CMS templates, while URL path segments can select a target record. This issue is fixed in version 1.2.14.","epss":{"date":"2026-11-12","percentile":0.0712,"score":0.00175},"exploits":[],"kev":null,"metrics":[{"score":6.1,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},{"score":6.1,"severity":"medium","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H","version":"3.1"}],"modifiedAt":1794506523356,"publishedAt":1794341173941,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/wintercms/winter/security/advisories/GHSA-p2ch-c2c3-4xm5"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/wintercms/winter/commit/353b23804dee2acf49fca996c72637040446824f"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/wintercms/winter/releases/tag/v1.2.14"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/wintercms/winter/commit/353b23804dee2acf49fca996c72637040446824f"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/wintercms/winter/releases/tag/v1.2.14"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/wintercms/winter/security/advisories/GHSA-p2ch-c2c3-4xm5"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-p2ch-c2c3-4xm5"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-p2ch-c2c3-4xm5"}],"remediation":[{"kind":"fix","source":"OSV GHSA-p2ch-c2c3-4xm5","text":"winter/wn-backend-module (Packagist): OSV reports a fixed version 1.2.14. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-p2ch-c2c3-4xm5"}],"revision":"6bafa6c3dd3fd5e4096df1c47e21a7d3262da71847ffd4afdc015e5c06064d81","sources":[{"modifiedAt":1794506523356,"name":"CNA: GitHub_M","retrievedAt":1794510571836,"url":"https://www.cve.org/CVERecord?id=CVE-2026-125339"},{"modifiedAt":1794341948410,"name":"NVD","retrievedAt":1794357097267,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125339"},{"modifiedAt":1794341704110,"name":"OSV / GitHub Security Advisories","retrievedAt":1794346793371,"url":"https://osv.dev/vulnerability/GHSA-p2ch-c2c3-4xm5"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794510584518,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-125339"}],"ssvc":{"assessedAt":1794500778986,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Winter CMS: CSRF through AJAX handler names reachable as backend page actions","updatedAt":1794510584518}