CVE-2023-37269: Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission ...

Description

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could have allowed a stored cross-site scripting (XSS) attack. To exploit the vulnerability, an attacker would already need to have developer or super user level permissions in Winter CMS. This means they would already have extensive access and control within the system. Additionally, to execute the XSS, the attacker would need to convince the victim to directly visit the URL of the maliciously uploaded SVG, and the application would have to be using local storage where uploaded files are served under the same domain as the application itself instead of a CDN. This is because all SVGs in Winter CMS are rendered through an `img` tag, which prevents any payloads from being executed directly. These two factors significantly limit the potential harm of this vulnerability. This issue has been patched in v1.2.3 through the inclusion of full support for SVG uploads and automatic sanitization of uploaded SVG files. As a workaround, one may apply the patches manually.

Metrics

CVSS 3.1

4.8/10

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS Probability

1.64%

73.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Wintercms	Winter	< 1.2.3

References

http://packetstormsecurity.com/files/173520/WinterCMS-1.2.2-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/wintercms/storm/commit/186d85d8fea2cae43afc807d39f68553c24e56bePatch
https://github.com/wintercms/winter/commit/fa50b4c7489b67ea80072f8ac9fe5294fce1df1cPatch
https://github.com/wintercms/winter/releases/tag/v1.2.3Release Notes
https://github.com/wintercms/winter/security/advisories/GHSA-wjw2-4j7j-6gc3Patch, Vendor Advisory
http://packetstormsecurity.com/files/173520/WinterCMS-1.2.2-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/wintercms/storm/commit/186d85d8fea2cae43afc807d39f68553c24e56bePatch
https://github.com/wintercms/winter/commit/fa50b4c7489b67ea80072f8ac9fe5294fce1df1cPatch
https://github.com/wintercms/winter/releases/tag/v1.2.3Release Notes
https://github.com/wintercms/winter/security/advisories/GHSA-wjw2-4j7j-6gc3Patch, Vendor Advisory

Timeline

Published: Jul 7, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-37269?

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could have allowed a stored cross-site scripting (XSS) attack. To exploit the vulnerability, an attacker would already need to have developer or super user level permissions in Winter CMS. This means they would already have extensive access and control within the system. Additionally, to execute the XSS, the attacker would need to convince the victim to directly visit the URL of the maliciously uploaded SVG, and the application would have to be using local storage where uploaded files are served under the same domain as the application itself instead of a CDN. This is because all SVGs in Winter CMS are rendered through an `img` tag, which prevents any payloads from being executed directly. These two factors significantly limit the potential harm of this vulnerability. This issue has been patched in v1.2.3 through the inclusion of full support for SVG uploads and automatic sanitization of uploaded SVG files. As a workaround, one may apply the patches manually.

How severe is CVE-2023-37269?

CVE-2023-37269 has a CVSS score of 4.8/10 (MEDIUM severity). The EPSS model estimates a 1.64% probability of exploitation in the next 30 days.

How do I fix CVE-2023-37269?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.