The Winter CMS backend module allowed users with the backend.manage_branding permission to provide custom CSS through Settings → Customize Backend → Styles. This CSS was compiled via the LESS parser and rendered on all backend pages without sanitization, enabling stored XSS attacks. The vulnerability is tracked as CVE-2026-32257 and has a CVSS 3.1 score of 8.1 (high severity). Exploitation requires high privileges (trusted backend access with UI interaction). The vulnerability was patched in version 1.2.13. A related issue exists in the editor markup styles field but is addressed separately.

An attacker with the backend.manage_branding permission can inject malicious CSS that executes in the context of the backend interface, potentially leading to credential theft or session hijacking of other backend users. However, exploitation requires already having trusted administrative access, which limits the overall risk to internal threat scenarios or compromised trusted accounts.

Update Winter CMS backend module to version 1.2.13 or later to apply the official patch. If immediate upgrade is not possible, manually apply the patch from commit d28f0b9474af79cfaa80eeb9d691f7a7c4469720. Additionally, restrict the backend.manage_branding permission to only trusted administrators and developers to reduce exposure.