Arbitrary File Disclosure in Winter CMS Versions up to 1.2.12

CVE-2026-63179

What is CVE-2026-63179?

Winter CMS, built on the Laravel PHP framework, has a vulnerability that allows authenticated backend users to disclose sensitive files read by the PHP process. This occurs due to improper handling of LESS source imports, enabling attackers to inject inline directives. The flaw affects multiple entry points, including fields related to custom styles and branding settings, leading to possible exposure of critical files such as the application environment file and database credentials. Users should upgrade to version 1.2.13 or later to mitigate this risk.

References