{"action":"Upgrade wintercms/winter to 1.2.3 or later.","affected":[{"fixed":"1.2.3","introduced":"0"}],"component":"wintercms/winter","cve_ids":["CVE-2023-37269"],"ecosystem":"Packagist","epss":0.027,"exploited":false,"fixed_versions":["1.2.3"],"ghsa_id":"GHSA-wjw2-4j7j-6gc3","id":"tcs_01M5KFA5V8D0XCTKZQP8HT9DW4","modified_at":"2026-09-10T03:49:57.324583575Z","published_at":"2023-07-07T21:20:42Z","references":["https://osv.dev/vulnerability/GHSA-wjw2-4j7j-6gc3","https://github.com/wintercms/winter/security/advisories/GHSA-wjw2-4j7j-6gc3","https://nvd.nist.gov/vuln/detail/CVE-2023-37269","https://github.com/wintercms/storm/commit/186d85d8fea2cae43afc807d39f68553c24e56be","https://github.com/wintercms/winter/commit/fa50b4c7489b67ea80072f8ac9fe5294fce1df1c","https://github.com/wintercms/winter","https://github.com/wintercms/winter/releases/tag/v1.2.3","http://packetstormsecurity.com/files/173520/WinterCMS-1.2.2-Cross-Site-Scripting.html"],"severity":{"label":"low","score":2},"sources":[{"source":"osv","source_id":"GHSA-wjw2-4j7j-6gc3","url":"https://osv.dev/vulnerability/GHSA-wjw2-4j7j-6gc3"}],"summary":"Winter CMS stored XSS through privileged upload of SVG file"}