Advisories for Composer/Winter/Wn-System-Module package

Affected versions of Winter CMS allow authenticated backend users with the cms.manage_assets permission ("Manage website assets - images, JavaScript files, CSS files") to disclose arbitrary files readable by the PHP process by placing an =include / =require directive in a theme JavaScript asset. Winter\Storm\Parse\Assetic\Filter\JavascriptImporter processes =include / =require directives found in comment blocks of JavaScript assets passed through System\Classes\CombineAssets. The directive target was resolved relative to the including file's own …

Affected versions of Winter CMS allow authenticated backend users with CMS template-editing permissions to escape the Twig sandbox ("safe mode") that is meant to restrict what template code can do. Using any of the following permissions, an attacker can read and modify arbitrary database records, execute arbitrary SQL (including DDL such as DROP TABLE), exfiltrate sensitive data such as backend administrator credentials, and achieve remote code execution by injecting PHP …

Winter is a free, open-source content management system. Prior to 1.2.4, users with the media.manage_media permission can upload files to the Media Manager and rename them after uploading. Previously, media manager files were only sanitized on upload, not on renaming, which could have allowed a stored XSS attack. This issue has been patched in v1.2.4.