CVE-2026-79774: Protection Mechanism Failure in wintercms winter

CVE-2026-79774 affects Winter CMS winter versions before 1.2.13. The vulnerability is an incomplete fix of a Twig sandbox escape in System\Twig\SecurityPolicy, permitting authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can leverage method forwarding via Eloquent models and query builders using methods such as saveQuietly(), deleteQuietly(), increment(), decrement(), and newQuery() to perform unauthorized database reads and modifications, execute arbitrary SQL commands, and inject PHP code into templates to achieve remote code execution.

An attacker with authenticated backend access and template-editing permissions can bypass sandbox restrictions, leading to unauthorized database access and modification, arbitrary SQL execution, and remote code execution. This poses a critical risk to the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 1.2.13 and the description references an incomplete fix, upgrading to version 1.2.13 or later is recommended once confirmed by the vendor. Until then, restrict template-editing permissions to trusted users only.