GHSA-2223-f22x-24cq is a medium-severity (CVSS 4.9) vulnerability in winter/wn-system-module. O3 Security confirms whether GHSA-2223-f22x-24cq is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Winter: Local File Inclusion through =include directives in JavaScript asset compilation
Real-World Exposure
winter/wn-system-moduleReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Impact
Affected versions of Winter CMS allow authenticated backend users with the cms.manage_assets permission ("Manage website assets - images, JavaScript files, CSS files") to disclose arbitrary files readable by the PHP process by placing an =include / =require directive in a theme JavaScript asset.
Winter\Storm\Parse\Assetic\Filter\JavascriptImporter processes =include / =require directives found in comment blocks of JavaScript assets passed through System\Classes\CombineAssets. The directive target was resolved relative to the including file's own directory with realpath() and inlined into the combined output with no confinement check, so a directive such as =include ../../../.env escaped the theme's asset tree and inlined an arbitrary server-readable file. The only restriction was that the target had to have a file extension, since extension-less names had .js appended to them.
Because the combined output is served through the combine/{file} route, which performs no authentication or authorization checks, the disclosed contents then became readable by unauthenticated visitors at a stable URL as soon as the asset was referenced by any template.
The leaked content includes any file the web process can read, most importantly the application .env file (disclosing APP_KEY and database credentials). Text files were disclosed intact; binary content was mangled by the minification pipeline.
This is the JavaScript-importer counterpart of GHSA-58fp-mcx6-7qf9 (Local File Inclusion through LESS @import directives) and of CVE-2023-52085 / GHSA-2x7r-93ww-cxrq — the same vulnerability class reached through a different asset combiner filter.
To actively exploit this issue, an attacker would need an authenticated backend account with the cms.manage_assets permission. By default this permission is assigned to the built-in Developer role. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general, as it grants direct write access to files that are combined and served publicly.
Patches
JavascriptImporter in Winter Storm now applies two independent gates to every =include / =require target:
- Only
.jstargets may be inlined. Any other extension is rejected before path resolution, which neutralises disclosure of non-JavaScript server files such as.env,.php, and.log. Extension-less includes are unaffected, as they are resolved to.jsbefore this check, exactly as before. - The resolved path must lie within the including file's own directory subtree or one of the caller-configured allowed import roots, enforced through the new
PathResolver::withinAny()helper. A rejected include emits a comment in place of the file contents (or throws, if the directive was=require).
The allowed-roots configuration is now shared between the JavaScript importer and the LESS compiler through a HasAllowedImportRoots trait, and System\Classes\CombineAssets configures both — along with the CSS @import filter, using the import validator added in assetic/framework v3.2.1 — with themes_path(), plugins_path(), and base_path('modules') as the allowed roots. This preserves the cross-tree imports that shipped themes and plugins legitimately use (e.g. a plugin asset importing a module asset) while confining everything else.
The backend permission descriptions for cms.manage_assets and cms.manage_content now also carry the same "should only be given to trusted users" warning that was already displayed for cms.manage_pages, cms.manage_layouts, and cms.manage_partials.
This security issue has been fixed in v1.2.13 (Winter core) and v1.2.13 (Winter Storm).
Workarounds
If you cannot upgrade, apply https://github.com/wintercms/storm/commit/fd673f4f32140c97c68b1ed705764b819747fbdf and https://github.com/wintercms/winter/commit/e09c8d3526f3583cb6c3476a021b885088ecd4bd manually. As an interim mitigation, remove the cms.manage_assets permission from any role that is not held by a fully trusted administrator or developer, and audit existing theme .js assets for =include / =require directives that resolve outside the theme's own asset directory.
References
- https://github.com/wintercms/winter/security/advisories/GHSA-58fp-mcx6-7qf9 — the LESS
@importcounterpart of this issue, which shares the same root cause and hardening approach. - https://github.com/wintercms/winter/security/advisories/GHSA-2x7r-93ww-cxrq (CVE-2023-52085) — earlier Local File Inclusion through LESS compilation.
Credit to Zyad Mohamed Elmahy (@elmahy111) for reporting the issue.
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected]
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | winter/wn-system-module | all versions | 1.2.13 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for winter/wn-system-module. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update winter/wn-system-module to 1.2.13 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-2223-f22x-24cq is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-2223-f22x-24cq is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-2223-f22x-24cq. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-2223-f22x-24cq in your dependencies?
O3 detects GHSA-2223-f22x-24cq across Packagist dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.