The flaw in Winter CMS involves missing per‑template permission checks in the Theme Editor AJAX handlers – an authenticated backend user with any CMS permission that the system knows about can trigger actions such as deleting layouts, modifying partials, or reading content files for template types outside the user’s authorized scope. The vulnerability also allows the AssetList widget to upload files to the active theme’s asset directory because the usual theme‑validation guard is omitted. These weaknesses give an attacker with minimal CMS privileges the ability to alter website structure, inject malicious assets, and compromise site integrity.

Winter CMS, versions up to and including 1.2.12. The fix is implemented in Winter CMS v1.2.13. All installations of the content management system built on the Laravel PHP framework that use those versions are affected.

The CVSS score of 6.8 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no public exploits are known. Exploitation requires an authenticated backend account that holds at least one CMS Theme Editor permission, so it is limited to environments where such credentials exist. Once compromised, the attacker can perform dangerous content manipulation or upload malicious files.