CVE-2026-54256

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend FileUpload form widget trusted an attacker-controlled file_id POST parameter when resolving the attachment it operates on, allowing an authenticated backend user to read and modify attachment records belonging to other users or records. The widget's getFileRecord() lookup resolved the posted id against the global system_files table without verifying that the file belonged to the widget's own relation, parent record, or deferred-binding session. Because all attachments share a single File model and table and attachment ids are sequential integers that are easily enumerated, a user reaching any form with a fileupload field, including the built-in My Account avatar field that requires no specific permission, could target arbitrary attachments to modify their title and description via onSaveAttachmentConfig and change their sort order via onSortAttachments, which passed posted ids straight to an unscoped update. CSRF tokens remain enforced, so exploitation requires a valid authenticated backend session with any level of access. This issue is fixed in version 1.2.13.

• CWE-284
• CWE-639

• https://github.com/wintercms/winter/commit/9cb0ae5f9d837db141ab111c6a7de8eed9603d25
• https://github.com/wintercms/winter/security/advisories/GHSA-3277-h8g9-qj5f

Published

Aug 26, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54249Pydantic AI is a Python agent framework for building Generat…6.8
• CVE-2026-5425The Widgets for Social Photo Feed plugin for WordPress is vu…7.2
• CVE-2026-54250K3s is a fully conformant production-ready Kubernetes distri…5.8
• CVE-2026-54251netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP…8.7
• CVE-2026-54253TS3 Manager is modern web interface for maintaining Teamspea…8.2
• CVE-2026-54254Cyberdrop-DL is a bulk asynchronous downloader for multiple …5.9
• CVE-2026-54257Electron is a framework for writing cross-platform desktop a…9.3
• CVE-2026-54258ZoneMinder is a free, open source closed-circuit television …6.5
• CVE-2026-54259Wagtail is an open source content management system built on…4.3
• CVE-2026-5426Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge…9.1
• CVE-2026-54260Wagtail is an open source content management system built on…2.7
• CVE-2026-54261Wagtail is an open source content management system built on…6.5