Detections
Analytics

SCA: security update for winter/wn-backend-module (GHSA-3277-h8g9-qj5f)

medium Tenable Cloud Security Plugin ID 446137

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and
 including 1.2.12, the backend FileUpload form widget trusted an attacker-controlled file_id POST parameter
 when resolving the attachment it operates on, allowing an authenticated backend user to read and modify
 attachment records belonging to other users or records. The widget's getFileRecord() lookup resolved the
 posted id against the global system_files table without verifying that the file belonged to the widget's
 own relation, parent record, or deferred-binding session. Because all attachments share a single File
 model and table and attachment ids are sequential integers that are easily enumerated, a user reaching any
 form with a fileupload field, including the built-in My Account avatar field that requires no specific
 permission, could target arbitrary attachments to modify their title and description via
 onSaveAttachmentConfig and change their sort order via onSortAttachments, which passed posted ids straight
 to an unscoped update. CSRF tokens remain enforced, so exploitation requires a valid authenticated backend
 session with any level of access. This issue is fixed in version 1.2.13. (CVE-2026-54256)

Solution

Update the winter/wn-backend-module library and its related packages to version 1.2.13 or later.

See Also

https://github.com/advisories/GHSA-3277-h8g9-qj5f

Plugin Details

Severity: Medium

ID: 446137

Version: Revision 1.2

Type: Local

Family: SCA Checks

Published: 8/20/2026

Updated: 8/27/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.1

Percentile: 7.92

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS Score Source: CVE-2026-54256

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/20/2026

Vulnerability Publication Date: 8/20/2026

Reference Information

CVE: CVE-2026-54256