A stored XSS flaw exists in the Asset Manager of Winter CMS versions prior to 1.2.10. The flaw allows a user with cms.manage_assets permission to upload aggressively crafted SVG files that are not automatically sanitized. When stored and later requested, the malicious script executes in any browser that loads the asset, potentially compromising confidentiality, integrity, or availability of the affected user’s session. The vulnerability is categorized under CWE‑79 and CWE‑80.

The issue affects installations of Winter CMS older than version 1.2.10. All users who can access the Asset Manager with the cms.manage_assets permission are at risk. The fix is released in version 1.2.10 and later.

The EPSS score is below 1% and the vulnerability is not included in the CISA KEV catalog, indicating a low probability of widespread exploitation. Exploitation requires that the attacker already possess a backend account with the cms.manage_assets privilege or compromise an account with that privilege. Attackers can then upload a malicious SVG via the Asset Manager, which when viewed by any logged‑in user will inject JavaScript into the page. Because the script runs with the privileges of the viewing user, an attacker could hijack sessions, steal cookies, or perform phishing actions.