CVE-2026-22254: 
PHP vulnerability analysis and mitigation

CVE-2026-22254 is a stored Cross-Site Scripting (XSS) vulnerability in the Winter CMS Asset Manager that allows authenticated backend users with the cms.manage_assets permission to upload unsanitized SVG files containing embedded malicious scripts. It affects Winter CMS versions up to and including 1.2.9 (Composer package winter/wn-cms-module). The vulnerability was published on February 4, 2026, and patched in version 1.2.10. The CVSS v3.1 base score is 3.5 (Low) per Feedly/NVD, though the GitHub Advisory Database rates it 0.0 due to no direct confidentiality, integrity, or availability impact in the base vector (Github Advisory, Winter Security Advisory).

The root cause is improper neutralization of script-related HTML tags in SVG files uploaded through the CMS Asset Manager (CWE-79, CWE-80). SVG files are XML-based and can embed JavaScript via elements such as <script> or event handlers (e.g., onload); prior to version 1.2.10, Winter CMS did not sanitize these files upon upload, allowing malicious content to persist on the server. The fix, applied in commit 8a7f74b, adds automatic SVG sanitization in modules/cms/widgets/AssetList.php using an Svg::extract() call before the file is moved to its final destination. Exploitation requires an authenticated backend session with the cms.manage_assets permission and user interaction (a victim must view or render the uploaded SVG) (Winter Security Advisory, Patch Commit).

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of other backend users' browser sessions, potentially enabling session hijacking, credential theft, or unauthorized actions within the CMS backend. The impact is limited to the backend environment and does not directly affect frontend visitors unless the malicious SVG is also rendered publicly. There is no direct availability impact, and the confidentiality and integrity impacts are low and scoped to the backend (Github Advisory, Winter Security Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.018% (0.026% per Feedly), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is further constrained by the requirement for an authenticated backend account with the elevated cms.manage_assets permission (Github Advisory, Winter Security Advisory).

1. Obtain backend access: Acquire a Winter CMS backend user account with the cms.manage_assets permission (through credential theft, social engineering, or insider access).
2. Craft a malicious SVG: Create an SVG file containing embedded JavaScript, for example:

<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.cookie)">
  <circle cx="50" cy="50" r="40"/>
</svg>

3. Upload via Asset Manager: Log into the Winter CMS backend, navigate to the CMS Asset Manager, and upload the crafted SVG file.
4. Trigger execution: Induce another backend user (e.g., an administrator) to view or preview the uploaded SVG asset, causing the embedded script to execute in their browser session.
5. Achieve objective: Leverage the executed script to steal session cookies, perform actions on behalf of the victim, or escalate privileges within the backend (Winter Security Advisory).

• File System: Presence of SVG files in the Winter CMS theme assets directory containing <script> tags, javascript: URIs, or inline event handlers (e.g., onload, onerror, onclick) that were not present before a recent upload.
• Logs: Backend access logs showing SVG file uploads by accounts with cms.manage_assets permission, particularly from unexpected IP addresses or at unusual times.
• Network: Outbound requests from administrator browsers to unknown external domains shortly after viewing asset pages, which may indicate exfiltration of session tokens or cookies via XSS payload.

Upgrade Winter CMS to version 1.2.10 or later, which applies automatic SVG sanitization upon upload in the Asset Manager (Winter Release v1.2.10). For installations that cannot be immediately upgraded, manually apply commit 8a7f74b to the modules/cms/widgets/AssetList.php file (Patch Commit). Additionally, restrict the cms.manage_assets permission exclusively to trusted administrators and developers, and audit existing user accounts to remove this permission from any accounts that do not require it (Winter Security Advisory).

The vulnerability was reported by security researcher iamunixtz and disclosed responsibly through GitHub's security advisory process. The Winter CMS maintainers published the advisory and patch on February 4, 2026, emphasizing that the cms.manage_assets permission should be reserved for trusted users. No significant broader media coverage or notable community debate has been identified beyond the standard advisory publication (Github Advisory).