-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability allows bypassing Safe Mode checks during template modification. Core template manipulation methods like setAttribute in Template.php would be responsible for enforcing content restrictions. The backend controller's save handler (onSave) is a logical entry point for template edits. The high confidence in Template::setAttribute stems from its direct role in modifying template content, while the controller method receives medium confidence due to typical MVC patterns, though exact implementation details are inferred without commit diffs. The patch commit wintercms/storm@03eb5ce likely added Safe Mode checks to these critical points.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| wintercms/winter | composer | < 1.0.475 | 1.0.475 |
| wintercms/winter | composer | >= 1.1.0, < 1.1.9 | 1.1.9 |
Ongoing coverage of React2Shell