The vulnerability arises because Winter CMS, versions 1.2.12 and earlier, compiles backend‑supplied LESS stylesheets without a safe import resolver. Authenticated users with backend permissions—typically those in the default Developer role—can insert @import directives that reference arbitrary file paths. When the parser fails to find a matching import root, it falls back to the raw path supplied by the attacker. This allows disclosure of any file readable by the PHP process, including sensitive configuration files such as .env, APP_KEY, and database credentials. The flaw is accessed through four application paths: the custom_css field in Brand Settings, the html_custom_styles field in Editor Settings, mail brand colour‑picker values concatenated into LESS, and theme .less, .sass, and .scss assets that are compiled when served.

Affected systems are installations of Winter CMS up to and including version 1.2.12. The issue does not impact other CMS products or newer Winter releases. All users with designated backend privileges can exploit it, and the default Developer role provides the necessary permissions. The problem is resolved in Winter CMS 1.2.13, where the LESS parser is instantiated with a safe import resolver.

The CVSS score of 4.9 indicates a moderate severity, and EPSS data is unavailable, so the likelihood of exploitation cannot be precisely quantified. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker requires a backend account with permissions such as the Developer role; user enumeration is not necessary. However, once the required role is present, the attacker can read any file the PHP process can access, which poses a significant confidentiality risk. Organizations should treat the vulnerability as a high‑risk item for accounts with backend privileges until the security fix is applied.