CVE-2026-63179: Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets

Affected versions of Winter CMS allow authenticated backend users with the following permissions to disclose arbitrary files readable by the PHP process by injecting @import (inline) "<path>" directives into LESS source that the backend compiles. Four entry points share the same root cause:

• Brand Settings BrandSetting.custom_css field (backend.manage_branding) — compiled inline into every backend page’s <style> block.
• Editor Settings EditorSetting.html_custom_styles field (backend.manage_editor) — compiled inline into every backend page’s <style> block.
• Mail Brand Settings MailBrandSetting colour-picker fields (system.manage_mail_templates) — values are concatenated into LESS source via Less_Parser::ModifyVars() with no escaping, so any value the form validator does not reject can carry an @import directive.
• Theme .less/.sass/.scss assets (cms.manage_assets) — compiled through System\Classes\CombineAssets when served, with the same Less_Parser configuration. Both absolute paths and .. traversal escape from the asset’s own tree were exploitable.

The leaked content includes any file the web process can read, most importantly the application .env file (disclosing APP_KEY and database credentials).

To actively exploit this issue, an attacker would need an authenticated backend account with one of the permissions listed above. By default these are assigned to the built-in Developer role.