GHSA-2223-F22X-24CQ

Winter: Local File Inclusion through =include directives in JavaScript asset compilation

Affected versions of Winter CMS allow authenticated backend users with the cms.manage_assets permission ("Manage website assets - images, JavaScript files, CSS files") to disclose arbitrary files readable by the PHP process by placing an =include / =require directive in a theme JavaScript asset.

Winter\Storm\Parse\Assetic\Filter\JavascriptImporter processes =include / =require directives found in comment blocks of JavaScript assets passed through System\Classes\CombineAssets. The directive target was resolved relative to the including file's own directory with realpath() and inlined into the combined output with no confinement check, so a directive such as =include ../../../.env escaped the theme's asset tree and inlined an arbitrary server-readable file. The only restriction was that the target had to have a file extension, since extension-less names had .js appended to them.

Because the combined output is served through the combine/{file} route, which performs no authentication or authorization checks, the disclosed contents then became readable by unauthenticated visitors at a stable URL as soon as the asset was referenced by any template.

The leaked content includes any file the web process can read, most importantly the application .env file (disclosing APP_KEY and database credentials). Text files were disclosed intact; binary content was mangled by the minification pipeline.

This is the JavaScript-importer counterpart of GHSA-58fp-mcx6-7qf9 (Local File Inclusion through LESS @import directives) and of CVE-2023-52085 / GHSA-2x7r-93ww-cxrq, the same vulnerability class reached through a different asset combiner filter.

To actively exploit this issue, an attacker would need an authenticated backend account with the cms.manage_assets permission. By default this permission is assigned to the built-in Developer role. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general, as it grants direct write access to files that are combined and served publicly.

Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.

GHSA-2223-F22X-24CQ has a CVSS score of 4.9 (Medium). The vector is network-reachable, high privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.2.13); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

JavascriptImporter in Winter Storm now applies two independent gates to every =include / =require target:

1. Only .js targets may be inlined. Any other extension is rejected before path resolution, which neutralises disclosure of non-JavaScript server files such as .env, .php, and .log. Extension-less includes are unaffected, as they are resolved to .js before this check, exactly as before.
2. The resolved path must lie within the including file's own directory subtree or one of the caller-configured allowed import roots, enforced through the new PathResolver::withinAny() helper. A rejected include emits a comment in place of the file contents (or throws, if the directive was =require).

The allowed-roots configuration is now shared between the JavaScript importer and the LESS compiler through a HasAllowedImportRoots trait, and System\Classes\CombineAssets configures both, along with the CSS @import filter, using the import validator added in assetic/framework v3.2.1, with themes_path(), plugins_path(), and base_path('modules') as the allowed roots. This preserves the cross-tree imports that shipped themes and plugins legitimately use (e.g. a plugin asset importing a module asset) while confining everything else.

The backend permission descriptions for cms.manage_assets and cms.manage_content now also carry the same "should only be given to trusted users" warning that was already displayed for cms.manage_pages, cms.manage_layouts, and cms.manage_partials.

This security issue has been fixed in v1.2.13 (Winter core) and v1.2.13 (Winter Storm).

1. What is GHSA-2223-F22X-24CQ? GHSA-2223-F22X-24CQ is a medium-severity path traversal vulnerability in winter/wn-system-module (composer), affecting versions < 1.2.13. It is fixed in 1.2.13. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
2. How severe is GHSA-2223-F22X-24CQ? GHSA-2223-F22X-24CQ has a CVSS score of 4.9 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of winter/wn-system-module are affected by GHSA-2223-F22X-24CQ? winter/wn-system-module (composer) versions < 1.2.13 is affected.
4. Is there a fix for GHSA-2223-F22X-24CQ? Yes. GHSA-2223-F22X-24CQ is fixed in 1.2.13. Upgrade to this version or later.
5. Is GHSA-2223-F22X-24CQ exploitable, and should I be worried? Whether GHSA-2223-F22X-24CQ is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether GHSA-2223-F22X-24CQ is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix GHSA-2223-F22X-24CQ? Upgrade winter/wn-system-module to 1.2.13 or later.