GHSA-8cfw-pcwh-v63w is a high-severity (CVSS 8.4) CWE-693 vulnerability in winter/wn-system-module. A fix is available for winter/wn-system-module — see the affected versions and patch details below.
Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)
Exploitation Status
No confirmed exploitation observed yet
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-8cfw-pcwh-v63w.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-8cfw-pcwh-v63w by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 382,621 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
winter/wn-system-moduleReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Impact
Affected versions of Winter CMS allow authenticated backend users with CMS template-editing permissions to escape the Twig sandbox ("safe mode") that is meant to restrict what template code can do. Using any of the following permissions, an attacker can read and modify arbitrary database records, execute arbitrary SQL (including DDL such as DROP TABLE), exfiltrate sensitive data such as backend administrator credentials, and achieve remote code execution by injecting PHP into a CMS page, layout, or partial code section:
cms.manage_pagescms.manage_layoutscms.manage_partials
This is an incomplete-fix follow-up to CVE-2024-54149 (GHSA-xhw3-4j3m-hq53). That fix added a blocklist of dangerous methods to System\Twig\SecurityPolicy, but the blocklist missed a large number of equivalent methods and did not account for the way Eloquent models forward calls to the query builder. As a result the sandbox could be bypassed through — among others — saveQuietly()/deleteQuietly(), increment()/decrement(), newQuery(), getConnection(), getConnectionResolver(), relation and pivot methods, and higher-order collection methods that execute callables.
To actively exploit this issue, an attacker would need an authenticated backend account with one of the permissions listed above. These permissions are intended for trusted developers/administrators, and the sandbox is the additional protection layer this advisory is concerned with.
Patches
System\Twig\SecurityPolicy has been reworked so that the blocklist reflects the real method-forwarding behaviour of the database layer rather than a flat list of method names. A method blocked on the query builder is now also blocked when it is reached through a model, Eloquent builder, or relation (via a transitive forwarder chain), which closes the __call forwarding escape that made the previous blocklist bypassable. In addition, the per-class blocklists have been expanded, the database connection and connection resolver are locked down, the source() and constant() Twig functions are restricted, and a SafeCollection/SafePaginator layer neutralises callable arguments passed to higher-order collection and paginator methods. Read-only query building continues to work as before; only data modification, raw SQL/connection access, and callable execution are blocked.
This security issue has been fixed in v1.2.13.
After upgrading, clear the compiled Twig template cache (e.g. php artisan cache:clear) so that existing templates recompile under the updated policy.
Workarounds
If you cannot upgrade immediately, apply https://github.com/wintercms/winter/commit/725bbcda232466f7f71381c271c6916573d576e6 manually. As an interim mitigation, restrict cms.manage_pages, cms.manage_layouts, and cms.manage_partials to fully trusted administrators only, since these permissions grant the ability to edit template code that the sandbox is designed to contain.
References
- Original issue: CVE-2024-54149 / GHSA-xhw3-4j3m-hq53 — this advisory addresses an incomplete fix for it.
Credit to Mounir Elsrogy (@M9nx) for reporting the issue.
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected]
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | winter/wn-system-module | ≥ 1.2.7&&< 1.2.13 | 1.2.13composer require winter/wn-system-module:^1.2.13 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for winter/wn-system-module, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update winter/wn-system-module to 1.2.13 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-8cfw-pcwh-v63w is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is GHSA-8cfw-pcwh-v63w in your dependencies?
Find it across Packagist, including transitive dependencies.