The vulnerability is a local file inclusion flaw in the JavascriptImporter filter, enabling authenticated users with cms.manage_assets permission to embed =include or =require directives in theme JavaScript files. This permits the inclusion of arbitrary server‑readable files, such as .env, which are then served through the combine route and become accessible to unauthenticated visitors, exposing application keys and database credentials.

All Winter CMS installations running versions prior to 1.2.13, including the standard winter product from Winter CMS. The issue applies to all deployments that allow authenticated users to manage assets within theme directories.

With a CVSS score of 6.9, the vulnerability presents a moderate risk. No EPSS score is available, and the weakness is not listed in CISA KEV catalog. Exploitation requires that an attacker already has authenticated access with cms.manage_assets rights; once achieved, the attacker can retrieve sensitive files and expose them to anyone who views the combined JavaScript output.