Packagist/winter/wn-backend-module: medium 6.1

Winter: CSRF through AJAX handler names reachable as backend page actions

Action: Upgrade winter/wn-backend-module to 1.2.14 or later.

composer require winter/wn-backend-module:1.2.14

Affected

Fixed versions

Sources

• osv: GHSA-p2ch-c2c3-4xm5
• https://github.com/wintercms/winter/security/advisories/GHSA-p2ch-c2c3-4xm5
• https://github.com/wintercms/winter/commit/353b23804dee2acf49fca996c72637040446824f
• https://github.com/wintercms/winter
• https://github.com/wintercms/winter/releases/tag/v1.2.14

published 2026-08-20T18:44:59Z · modified 2026-08-20T19:00:08.915354180Z · JSON