GHSA-8CFW-PCWH-V63W

Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)

Affected versions of Winter CMS allow authenticated backend users with CMS template-editing permissions to escape the Twig sandbox ("safe mode") that is meant to restrict what template code can do. Using any of the following permissions, an attacker can read and modify arbitrary database records, execute arbitrary SQL (including DDL such as DROP TABLE), exfiltrate sensitive data such as backend administrator credentials, and achieve remote code execution by injecting PHP into a CMS page, layout, or partial code section:

• cms.manage_pages
• cms.manage_layouts
• cms.manage_partials

This is an incomplete-fix follow-up to CVE-2024-54149 (GHSA-xhw3-4j3m-hq53). That fix added a blocklist of dangerous methods to System\Twig\SecurityPolicy, but the blocklist missed a large number of equivalent methods and did not account for the way Eloquent models forward calls to the query builder. As a result the sandbox could be bypassed through, among others, saveQuietly()/deleteQuietly(), increment()/decrement(), newQuery(), getConnection(), getConnectionResolver(), relation and pivot methods, and higher-order collection methods that execute callables.

To actively exploit this issue, an attacker would need an authenticated backend account with one of the permissions listed above. These permissions are intended for trusted developers/administrators, and the sandbox is the additional protection layer this advisory is concerned with.

GHSA-8CFW-PCWH-V63W has a CVSS score of 8.4 (High). The vector is network-reachable, high privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.2.13); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

System\Twig\SecurityPolicy has been reworked so that the blocklist reflects the real method-forwarding behaviour of the database layer rather than a flat list of method names. A method blocked on the query builder is now also blocked when it is reached through a model, Eloquent builder, or relation (via a transitive forwarder chain), which closes the __call forwarding escape that made the previous blocklist bypassable. In addition, the per-class blocklists have been expanded, the database connection and connection resolver are locked down, the source() and constant() Twig functions are restricted, and a SafeCollection/SafePaginator layer neutralises callable arguments passed to higher-order collection and paginator methods. Read-only query building continues to work as before; only data modification, raw SQL/connection access, and callable execution are blocked.

This security issue has been fixed in v1.2.13.

After upgrading, clear the compiled Twig template cache (e.g. php artisan cache:clear) so that existing templates recompile under the updated policy.

1. What is GHSA-8CFW-PCWH-V63W? GHSA-8CFW-PCWH-V63W is a high-severity security vulnerability in winter/wn-system-module (composer), affecting versions >= 1.2.7, < 1.2.13. It is fixed in 1.2.13.
2. How severe is GHSA-8CFW-PCWH-V63W? GHSA-8CFW-PCWH-V63W has a CVSS score of 8.4 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of winter/wn-system-module are affected by GHSA-8CFW-PCWH-V63W? winter/wn-system-module (composer) versions >= 1.2.7, < 1.2.13 is affected.
4. Is there a fix for GHSA-8CFW-PCWH-V63W? Yes. GHSA-8CFW-PCWH-V63W is fixed in 1.2.13. Upgrade to this version or later.
5. Is GHSA-8CFW-PCWH-V63W exploitable, and should I be worried? Whether GHSA-8CFW-PCWH-V63W is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether GHSA-8CFW-PCWH-V63W is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix GHSA-8CFW-PCWH-V63W? Upgrade winter/wn-system-module to 1.2.13 or later.

Other vulnerabilities in winter/wn-system-module