{"id":"CVE-2026-125341","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-125341","summary":"Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\\Widgets\\Lists::evalImageTypeValue() interpolates the result of ImageResizer::filterGetUrl()…","details":"Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\\Widgets\\Lists::evalImageTypeValue() interpolates the result of ImageResizer::filterGetUrl() into a single-quoted image source attribute without escaping it. In a third-party plugin that renders an attacker-influenced value through an image list column, an unsupported image value is returned verbatim, can break out of the attribute, and can inject event handlers that execute when a backend user views the list. Winter core ships no image list column, so a default installation is unaffected. This issue is fixed in version 1.2.14.","published":"2026-11-10T20:19:08.703","modified":"2026-11-10T20:19:08.703","cvss":{"score":2,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/wintercms/winter/commit/0941c9816181095fe35d58e78e6d0c4a49238967","label":"wintercms/winter@0941c98"},"references":[{"type":"WEB","url":"https://github.com/wintercms/winter/commit/0941c9816181095fe35d58e78e6d0c4a49238967"},{"type":"WEB","url":"https://github.com/wintercms/winter/releases/tag/v1.2.14"},{"type":"WEB","url":"https://github.com/wintercms/winter/security/advisories/GHSA-7mpf-4465-7fc2"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-11-10T20:19:08.703"}}