CVE-2026-79774
1 advisory.
Packagist/winter/wn-system-module CVE-2026-79774: high 8.4
Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)
Action: Upgrade winter/wn-system-module to 1.2.13 or later.
composer require winter/wn-system-module:1.2.13Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.2.7 | 1.2.13 | - |
Fixed versions
| 1.2.13 |
Sources
- osv: GHSA-8cfw-pcwh-v63w
- https://github.com/wintercms/winter/security/advisories/GHSA-8cfw-pcwh-v63w
- https://github.com/wintercms/winter/commit/725bbcda232466f7f71381c271c6916573d576e6
- https://github.com/advisories/GHSA-xhw3-4j3m-hq53
- https://github.com/wintercms/winter
- https://github.com/wintercms/winter/releases/tag/v1.2.13
CVE-2026-79774 · published · modified · JSON