{"affected":[{"product":"winter","source":"CNA: GitHub_M","vendor":"wintercms","versions":[{"status":"affected","version":">= 1.1.0, < 1.2.14"}]},{"defaultStatus":"unaffected","ecosystem":"Packagist","packageName":"winter/wn-backend-module","product":"winter/wn-backend-module","source":"OSV GHSA-7mpf-4465-7fc2","vendor":"","versions":[{"status":"affected","version":"v1.1.10","versionType":"Packagist"},{"status":"affected","version":"v1.1.11","versionType":"Packagist"},{"status":"affected","version":"v1.1.2","versionType":"Packagist"},{"status":"affected","version":"v1.1.3","versionType":"Packagist"},{"status":"affected","version":"v1.1.4","versionType":"Packagist"},{"status":"affected","version":"v1.1.5","versionType":"Packagist"},{"status":"affected","version":"v1.1.6","versionType":"Packagist"},{"status":"affected","version":"v1.1.7","versionType":"Packagist"},{"status":"affected","version":"v1.1.8","versionType":"Packagist"},{"status":"affected","version":"v1.1.9","versionType":"Packagist"},{"status":"affected","version":"v1.2.0","versionType":"Packagist"},{"status":"affected","version":"v1.2.1","versionType":"Packagist"},{"status":"affected","version":"v1.2.10","versionType":"Packagist"},{"status":"affected","version":"v1.2.11","versionType":"Packagist"},{"status":"affected","version":"v1.2.12","versionType":"Packagist"},{"status":"affected","version":"v1.2.13","versionType":"Packagist"},{"status":"affected","version":"v1.2.2","versionType":"Packagist"},{"status":"affected","version":"v1.2.3","versionType":"Packagist"},{"status":"affected","version":"v1.2.4","versionType":"Packagist"},{"status":"affected","version":"v1.2.5","versionType":"Packagist"},{"status":"affected","version":"v1.2.6","versionType":"Packagist"},{"status":"affected","version":"v1.2.7","versionType":"Packagist"},{"status":"affected","version":"v1.2.8","versionType":"Packagist"},{"status":"affected","version":"v1.2.9","versionType":"Packagist"},{"events":[{"introduced":"1.1.0"},{"fixed":"1.2.14"}],"status":"unknown","version":"1.1.0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-125341","cwes":["CWE-79"],"description":"Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\\Widgets\\Lists::evalImageTypeValue() interpolates the result of ImageResizer::filterGetUrl() into a single-quoted image source attribute without escaping it. In a third-party plugin that renders an attacker-influenced value through an image list column, an unsupported image value is returned verbatim, can break out of the attribute, and can inject event handlers that execute when a backend user views the list. Winter core ships no image list column, so a default installation is unaffected. This issue is fixed in version 1.2.14.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":2,"severity":"low","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1794344526569,"publishedAt":1794341299027,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/wintercms/winter/security/advisories/GHSA-7mpf-4465-7fc2"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/wintercms/winter/commit/0941c9816181095fe35d58e78e6d0c4a49238967"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/wintercms/winter/releases/tag/v1.2.14"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-7mpf-4465-7fc2"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-7mpf-4465-7fc2"}],"remediation":[{"kind":"fix","source":"OSV GHSA-7mpf-4465-7fc2","text":"winter/wn-backend-module (Packagist): OSV reports a fixed version 1.2.14. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-7mpf-4465-7fc2"}],"revision":"904b8c42b3063b7c010be3c7fb543b1df954d9957f31b7acf071c71e67802543","sources":[{"modifiedAt":1794344526569,"name":"CNA: GitHub_M","retrievedAt":1794346794500,"url":"https://www.cve.org/CVERecord?id=CVE-2026-125341"},{"modifiedAt":1794341704137,"name":"OSV / GitHub Security Advisories","retrievedAt":1794346795518,"url":"https://osv.dev/vulnerability/GHSA-7mpf-4465-7fc2"}],"ssvc":{"assessedAt":1794344509550,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Winter CMS: Stored XSS through Backend List widget image columns","updatedAt":1794346795518}