CVE-2026-79773: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in wintercms winter

CVE-2026-79773 describes a local file inclusion vulnerability in Winter CMS prior to version 1.2.13. The flaw exists in the JavascriptImporter filter, which permits authenticated users with cms.manage_assets permission to include arbitrary files by placing =include or =require directives in theme JavaScript assets. This can lead to disclosure of sensitive server-readable files outside the intended theme directory, including configuration files like .env. The combined JavaScript output served via the combine route is accessible to unauthenticated users, resulting in exposure of sensitive application secrets and database credentials.

An attacker with authenticated access and cms.manage_assets permission can disclose arbitrary files on the server, including sensitive configuration files such as .env. This leads to exposure of application keys and database credentials to unauthenticated users, potentially compromising the confidentiality of the application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict cms.manage_assets permissions to trusted users only and monitor for suspicious use of the JavascriptImporter filter. Avoid placing sensitive information in files accessible via theme assets.