{"action":"Upgrade winter/wn-cms-module to 1.0.476 or later.","affected":[{"fixed":"1.2.7","introduced":"1.2.0"},{"fixed":"1.1.11","introduced":"1.1.0"},{"fixed":"1.0.476","introduced":"0"}],"component":"winter/wn-cms-module","cve_ids":["CVE-2024-54149"],"ecosystem":"Packagist","epss":0.0042,"exploited":false,"fixed_versions":["1.2.7","1.1.11","1.0.476"],"ghsa_id":"GHSA-xhw3-4j3m-hq53","id":"tcs_01M5KFB3KPQTBMSH87MSMFH4X3","modified_at":"2026-09-10T03:50:21.801708532Z","published_at":"2024-12-09T20:41:41Z","references":["https://osv.dev/vulnerability/GHSA-xhw3-4j3m-hq53","https://github.com/wintercms/winter/security/advisories/GHSA-xhw3-4j3m-hq53","https://nvd.nist.gov/vuln/detail/CVE-2024-54149","https://github.com/wintercms/winter/commit/fb88e6fabde3b3278ce1844e581c87dcf7daee22","https://github.com/wintercms/winter"],"severity":{"label":"high","score":8.4},"sources":[{"source":"osv","source_id":"GHSA-xhw3-4j3m-hq53","url":"https://osv.dev/vulnerability/GHSA-xhw3-4j3m-hq53"}],"summary":"Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion"}