{"uuid": "70845fd4-e020-47dc-a9fb-988646a8559e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-54149", "type": "seen", "source": "https://gist.github.com/alon710/5476f02ee350d0dd102b681b35e1425f", "content": "# GHSA-8CFW-PCWH-V63W: GHSA-8CFW-PCWH-V63W: Authenticated Twig Sandbox Escape and Remote Code Execution in Winter CMS\n\n> **CVSS Score:** 8.5\n> **Published:** 2026-08-20\n> **Full Report:** https://cvereports.com/reports/GHSA-8CFW-PCWH-V63W\n\n## Summary\nAn authenticated Twig sandbox escape vulnerability in Winter CMS allows users with template-editing privileges to bypass sandbox restrictions and execute arbitrary PHP code. This vulnerability represents a complete bypass of the sandbox protections introduced by the previous patch for CVE-2024-54149.\n\n## TL;DR\nA sandbox escape bypass in Winter CMS allows authenticated users with template management access to execute arbitrary code via dynamic magic method forwarding, higher-order collection parameters, and custom AST node manipulation.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94\n- **Attack Vector**: Network (Authenticated)\n- **CVSS**: 8.5 (High)\n- **Exploit Status**: PoC Available\n- **Mitigation Status**: Patched in v1.2.13\n\n## Affected Systems\n\n- Winter CMS Core Module\n- **Winter CMS**: < 1.2.13 (Fixed in: `1.2.13`)\n\n## Mitigation\n\n- Upgrade to Winter CMS v1.2.13 or higher.\n- Restrict backend template editing permissions to fully trusted users.\n- Implement filesystem write restrictions on directories containing themes and compiled views.\n\n**Remediation Steps:**\n1. Run 'composer update winter/composer' to fetch the latest Winter CMS packages.\n2. Verify that the system module is updated to v1.2.13 or higher.\n3. Review the administrative permissions matrix and audit accounts with access to CMS layouts, pages, and partials.\n4. Configure log monitoring to track SecurityNotAllowedMethodError exceptions.\n\n## References\n\n- [Core Fix Commit (GHSA-8CFW-PCWH-V63W)](https://github.com/wintercms/winter/commit/725bbcda232466f7f71381c271c6916573d576e6)\n- [Patch Commit (CVE-2024-54149)](https://github.com/wintercms/winter/commit/fb88e6fabde3b3278ce1844e581c87dcf7daee22)\n- [Exploit Repository](https://github.com/tahaafarooq/wintercms-authenticated-rce-exploit)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-8CFW-PCWH-V63W) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-21T19:32:14.051592Z"}