CVE-2026-63179: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in wintercms winter

CVE-2026-63179 is a path traversal vulnerability (CWE-22) in Winter CMS (winter) affecting versions up to 1.2.12. Authenticated backend users with permissions (such as those assigned to the Developer role) can inject @import (inline) directives into LESS source fields that the backend compiles without a safe import resolver. This allows the LESS parser to fall back to attacker-supplied paths, including absolute paths and directory traversal sequences, enabling disclosure of arbitrary files readable by the PHP process. Key sensitive files such as the application .env file containing APP_KEY and database credentials can be accessed. The flaw is reachable through multiple entry points including Brand Settings custom_css, Editor Settings html_custom_styles, Mail Brand Settings colour-picker fields, and theme .less, .sass, and .scss assets. The vulnerability is resolved in Winter CMS version 1.2.13.

An attacker with authenticated backend access and appropriate permissions can read arbitrary files on the server that the PHP process can access. This includes sensitive configuration files such as the .env file, which may contain critical secrets like APP_KEY and database credentials. The vulnerability does not allow code execution or denial of service but leads to confidentiality loss of sensitive information.

Upgrade Winter CMS to version 1.2.13 or later, where this vulnerability is fixed. Until then, restrict backend user permissions to trusted users only, especially those with the Developer role or equivalent permissions that allow LESS source injection. No other mitigations are documented.