Twig Sandbox Escape Vulnerability in Winter CMS by Winter

CVE-2026-79774

What is CVE-2026-79774?

Winter CMS versions prior to 1.2.13 are affected by an incomplete fix for a Twig sandbox escape vulnerability within System\Twig\SecurityPolicy. This flaw allows authenticated users with permissions to edit templates to circumvent sandbox protections. Malicious actors can exploit this weakness through method forwarding via Eloquent models and query builders using methods such as saveQuietly(), deleteQuietly(), increment(), decrement(), and newQuery(). Consequently, attackers can read and modify arbitrary database records, execute arbitrary SQL queries, and potentially leverage the situation to execute remote code by injecting PHP into the template code sections.

References