CVE-2026-125341

Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\Widgets\Lists::evalImageTypeValue() interpolates the result of ImageResizer::filterGetUrl() into a single-quoted image source attribute without escaping it. In a third-party plugin that renders an attacker-influenced value through an image list column, an unsupported image value is returned verbatim, can break out of the attribute, and can inject event handlers that execute when a backend user views the list. Winter core ships no image list column, so a default installation is unaffected. This issue is fixed in version 1.2.14.

• CWE-79

• https://github.com/wintercms/winter/commit/0941c9816181095fe35d58e78e6d0c4a49238967
• https://github.com/wintercms/winter/releases/tag/v1.2.14
• https://github.com/wintercms/winter/security/advisories/GHSA-7mpf-4465-7fc2

Published

Nov 10, 2026

Last Modified

Nov 10, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-125335Forge (also called node-forge) is a native implementation of…3.7
• CVE-2026-125336Forge (also called node-forge) is a native implementation of…7.4
• CVE-2026-125337Winter CMS is a content management system built on the Larav…8.3
• CVE-2026-125338Winter CMS is a content management system built on the Larav…4.5
• CVE-2026-125339Winter CMS is a content management system built on the Larav…6.1
• CVE-2026-125340Winter CMS is a content management system built on the Larav…4.5
• CVE-2026-125342Uninitialized resource in GPU in Google Chrome prior to 157.…4.7
• CVE-2026-125343Buffer overflow in Compositing in Google Chrome prior to 157…8.3
• CVE-2026-125344Type confusion in V8 in Google Chrome prior to 157.0.8103.50…8.8
• CVE-2026-125345Uninitialized resource in WebGL in Google Chrome prior to 15…4.7
• CVE-2026-125346Use after free in XML in Google Chrome prior to 157.0.8103.5…8.8
• CVE-2026-125347Incorrect authorization in FileSystem in Google Chrome prior…9.6