MEDIUM4.9Packagist
GHSA-2223-f22x-24cq· CVE-2026-79773Winter: Local File Inclusion through =include directives in JavaScript asset compilation
Modified: 8/27/2026
package
Packagist/winter/wn-system-module
pkg:packagist/winter/wn-system-module
LOW2.0Packagist
GHSA-4wvw-75qh-fqjp· CVE-2023-52083Winter CMS Stored XSS through privileged upload of Media Manager file followed by renaming
Modified: 9/10/2026
HIGH8.4Packagist
GHSA-8cfw-pcwh-v63w· CVE-2026-79774Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)
Modified: 8/27/2026