{"id":"GHSA-58fp-mcx6-7qf9","summary":"Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets","details":"### Impact\n\nAffected versions of Winter CMS allow authenticated backend users with the following permissions to disclose arbitrary files readable by the PHP process by injecting `@import (inline) \"\u003cpath\u003e\"` directives into LESS source that the backend compiles. Four entry points share the same root cause:\n\n- **Brand Settings** `BrandSetting.custom_css` field (`backend.manage_branding`) — compiled inline into every backend page's `\u003cstyle\u003e` block.\n- **Editor Settings** `EditorSetting.html_custom_styles` field (`backend.manage_editor`) — compiled inline into every backend page's `\u003cstyle\u003e` block.\n- **Mail Brand Settings** `MailBrandSetting` colour-picker fields (`system.manage_mail_templates`) — values are concatenated into LESS source via `Less_Parser::ModifyVars()` with no escaping, so any value the form validator does not reject can carry an `@import` directive.\n- **Theme `.less`/`.sass`/`.scss` assets** (`cms.manage_assets`) — compiled through `System\\Classes\\CombineAssets` when served, with the same `Less_Parser` configuration. Both absolute paths and `..` traversal escape from the asset's own tree were exploitable.\n\nThe leaked content includes any file the web process can read, most importantly the application `.env` file (disclosing `APP_KEY` and database credentials).\n\nTo actively exploit this issue, an attacker would need an authenticated backend account with one of the permissions listed above. By default these are assigned to the built-in Developer role.\n\n### Patches\n\nThe root cause is in the `wikimedia/less.php` integration in [Winter Storm](https://github.com/wintercms/storm): `Less_Parser` was instantiated without a safe import resolver, and its `Less_FileManager::getFilePath()` falls back to the raw attacker-supplied path when no candidate root matches. Storm now ships a `LessImportResolver` that uses the callable form of `Less_Parser::SetImportDirs()` to refuse any `@import` whose resolved path lies outside the calling context's allowed roots, defeating both absolute paths and `..` traversal at the parser level.\n\nThe four sinks have been updated to use the resolver. The three settings models pass no allowed roots (deny-all) because the bundled stylesheets ship no `@import` directives and the user fields have no legitimate use for them. `System\\Classes\\CombineAssets` configures the theme-asset compiler with `themes_path()`, `plugins_path()`, and `base_path('modules')` as allowed roots, preserving real cross-tree imports observed in shipped themes and plugins.\n\nThis security issue has been fixed in [v1.2.13](https://github.com/wintercms/winter/commit/130f0ea43e9228bf0d129b481da1cdfbcc4b4456) (Winter core) and [v1.2.13](https://github.com/wintercms/storm/commit/af770331c683e628533a6ec2991285d6e10a4d6c) (Winter Storm).\n\n### Workarounds\n\nIf you cannot upgrade, apply https://github.com/wintercms/storm/commit/af770331c683e628533a6ec2991285d6e10a4d6c and https://github.com/wintercms/winter/commit/130f0ea43e9228bf0d129b481da1cdfbcc4b4456 manually. As an interim mitigation, remove `cms.manage_assets` from any non-trusted role and clear any non-empty value from the Brand Settings `custom_css` and Editor Settings `html_custom_styles` fields.\n\n### References\n\nSee https://github.com/octobercms/october/security/advisories/GHSA-3888-q23f-x7qh for the related (but distinct in scope) October CMS advisory addressing the theme-asset compiler path. The Brand/Editor/Mail Brand Settings sinks reported in this advisory are not covered by the October patch.\n\nCredit to Nguyen Van Hiep ([@hypnguyen1209](https://github.com/hypnguyen1209)) from Lo Security for reporting the issue.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n- Email us at [hello@wintercms.com](mailto:hello@wintercms.com)","aliases":["CVE-2026-63179"],"modified":"2026-08-20T19:11:16.571989Z","published":"2026-08-20T18:43:33Z","database_specific":{"cwe_ids":["CWE-22"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-08-20T18:43:33Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/wintercms/winter/security/advisories/GHSA-58fp-mcx6-7qf9"},{"type":"WEB","url":"https://github.com/wintercms/storm/commit/af770331c683e628533a6ec2991285d6e10a4d6c"},{"type":"WEB","url":"https://github.com/wintercms/winter/commit/130f0ea43e9228bf0d129b481da1cdfbcc4b4456"},{"type":"PACKAGE","url":"https://github.com/wintercms/winter"},{"type":"WEB","url":"https://github.com/wintercms/winter/releases/tag/v1.2.13"}],"affected":[{"package":{"name":"winter/wn-backend-module","ecosystem":"Packagist","purl":"pkg:composer/winter/wn-backend-module"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.13"}]}],"versions":["v1.0.473","v1.0.474","v1.0.475","v1.1.10","v1.1.11","v1.1.2","v1.1.3","v1.1.4","v1.1.5","v1.1.6","v1.1.7","v1.1.8","v1.1.9","v1.2.0","v1.2.1","v1.2.10","v1.2.11","v1.2.12","v1.2.2","v1.2.3","v1.2.4","v1.2.5","v1.2.6","v1.2.7","v1.2.8","v1.2.9"],"database_specific":{"last_known_affected_version_range":"\u003c= 1.2.12","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-58fp-mcx6-7qf9/GHSA-58fp-mcx6-7qf9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}]}