{"vulnerability": "CVE-2024-54149", "sightings": [{"uuid": "8b67d36d-6138-4750-b9db-2dde1599bfed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-54149", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113624874021159386", "content": "", "creation_timestamp": "2024-12-09T20:59:45.418070Z"}, {"uuid": "a6cba5f3-8064-48b5-b33f-32251b2689ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-54149", "type": "seen", "source": "https://t.me/cvedetector/12448", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-54149 - Winter CMS Twig File Sandbox Bypass Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-54149 \nPublished : Dec. 9, 2024, 9:15 p.m. | 37\u00a0minutes ago \nDescription : Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on Twig files and modify resources such as theme customisation values or modify, or remove, templates in the theme even if not provided direct access via the permissions. As all objects passed through to Twig are references to the live objects, it is also possible to also manipulate model data if models are passed directly to Twig, including changing attributes or even removing records entirely. In most cases, this is unwanted behavior and potentially dangerous. To actively exploit this security issue, an attacker would need access to the Backend with a user account with any of the following permissions: `cms.manage_layouts`; `cms.manage_pages`; or `cms.manage_partials`. The Winter CMS maintainers strongly recommend that these permissions only be reserved to trusted administrators and developers in general. The maintainers of Winter CMS have significantly increased the scope of the sandbox, effectively making all models and datasources read-only in Twig, in versions 1.2.7, 1.1.11, and 1.0.476. Thse who cannot upgrade may apply commit fb88e6fabde3b3278ce1844e581c87dcf7daee22 to their Winter CMS installation manually to resolve the issue. In the rare event that a Winter user was relying on being able to write to models/datasources within their Twig templates, they should instead use or create components to make changes to their models. \nSeverity: 8.4 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"09 Dec 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-12-09T23:04:28.000000Z"}, {"uuid": "70845fd4-e020-47dc-a9fb-988646a8559e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-54149", "type": "seen", "source": "https://gist.github.com/alon710/5476f02ee350d0dd102b681b35e1425f", "content": "# GHSA-8CFW-PCWH-V63W: GHSA-8CFW-PCWH-V63W: Authenticated Twig Sandbox Escape and Remote Code Execution in Winter CMS\n\n> **CVSS Score:** 8.5\n> **Published:** 2026-08-20\n> **Full Report:** https://cvereports.com/reports/GHSA-8CFW-PCWH-V63W\n\n## Summary\nAn authenticated Twig sandbox escape vulnerability in Winter CMS allows users with template-editing privileges to bypass sandbox restrictions and execute arbitrary PHP code. This vulnerability represents a complete bypass of the sandbox protections introduced by the previous patch for CVE-2024-54149.\n\n## TL;DR\nA sandbox escape bypass in Winter CMS allows authenticated users with template management access to execute arbitrary code via dynamic magic method forwarding, higher-order collection parameters, and custom AST node manipulation.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94\n- **Attack Vector**: Network (Authenticated)\n- **CVSS**: 8.5 (High)\n- **Exploit Status**: PoC Available\n- **Mitigation Status**: Patched in v1.2.13\n\n## Affected Systems\n\n- Winter CMS Core Module\n- **Winter CMS**: < 1.2.13 (Fixed in: `1.2.13`)\n\n## Mitigation\n\n- Upgrade to Winter CMS v1.2.13 or higher.\n- Restrict backend template editing permissions to fully trusted users.\n- Implement filesystem write restrictions on directories containing themes and compiled views.\n\n**Remediation Steps:**\n1. Run 'composer update winter/composer' to fetch the latest Winter CMS packages.\n2. Verify that the system module is updated to v1.2.13 or higher.\n3. Review the administrative permissions matrix and audit accounts with access to CMS layouts, pages, and partials.\n4. Configure log monitoring to track SecurityNotAllowedMethodError exceptions.\n\n## References\n\n- [Core Fix Commit (GHSA-8CFW-PCWH-V63W)](https://github.com/wintercms/winter/commit/725bbcda232466f7f71381c271c6916573d576e6)\n- [Patch Commit (CVE-2024-54149)](https://github.com/wintercms/winter/commit/fb88e6fabde3b3278ce1844e581c87dcf7daee22)\n- [Exploit Repository](https://github.com/tahaafarooq/wintercms-authenticated-rce-exploit)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-8CFW-PCWH-V63W) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-21T19:32:14.051592Z"}]}