CVE-2026-32257: Winter CMS Faces Stored XSS Issue, Follow-Up Fix Required After Incomplete Patch

Winter CMS has addressed a stored cross-site scripting vulnerability in its backend branding functionality, tracked as CVE-2026-32257. The vulnerability affects Winter CMS installations using vulnerable versions of the winter/wn-backend-module package and was initially fixed in version 1.2.13. A later security advisory, however, identified an incomplete aspect of that fix and released an additional patch in version 1.2.14.

Winter CMS Vulnerability Rated High

CVE-2026-32257 is a Stored Cross-Site Scripting (XSS) vulnerability affecting Winter CMS versions prior to 1.2.13. The issue was disclosed by the Winter CMS project on August 7, 2026, and published to the GitHub Advisory Database on August 12. It is classified as CWE-79 and carries a CVSS v3.1 score of 8.1 (High). citeturn0search1turn0search0

The vulnerability affects the backend's Brand Settings → Customize Backend → Styles functionality. Users with the backend.manage_branding permission can provide custom CSS, which is processed by the LESS CSS parser and rendered across backend pages.

According to the Winter CMS advisory, the compiled output was not sufficiently sanitized in affected releases, creating the possibility of stored XSS against backend users. citeturn0search1

What Is CVE-2026-32257?

CVE-2026-32257 is not an unauthenticated vulnerability that can simply be exploited by any visitor to a Winter CMS website.

An attacker would first need trusted backend access with the backend.manage_branding permission. Winter CMS specifically recommends restricting this permission to trusted administrators and developers. citeturn0search1

The original CVSS vector is:

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

This reflects a vulnerability that requires high privileges and user interaction, despite its potentially significant impact on confidentiality and integrity.

How the Issue Affected the CMS

The vulnerable functionality involved custom backend styles.

At a high level, the affected process was:

Backend User
      │
      ▼
Customize Backend → Styles
      │
      ▼
Custom CSS
      │
      ▼
LESS Processing
      │
      ▼
Insufficient Sanitization
      │
      ▼
Backend Rendering
      │
      ▼
Potential Stored XSS

The security issue was caused by unsafe handling of the generated style output before it was rendered in the backend.

Because the content could be stored and subsequently rendered to backend users, the issue falls into the stored XSS category rather than being limited to a single reflected request.

The Initial Fix

Winter CMS initially addressed CVE-2026-32257 in version 1.2.13.

The first patch applied strip_tags() to the output generated by the relevant CSS rendering functions. At the time, administrators were advised to upgrade to 1.2.13 or later. citeturn0search1

However, a subsequent Winter CMS advisory published on August 20, 2026 revealed that the initial remediation did not completely eliminate the problem.

Follow-Up Advisory Reveals Cached Output Issue

The later advisory, GHSA-5cwr-5jxg-pcf6, explains that the rendering functions used Cache::forever() to store compiler output.

The sanitization introduced in version 1.2.13 was applied when the cached value was initially generated, but the cached value itself could subsequently be returned without the same sanitization being applied.

As a result, the earlier fix could leave an unsafe cached value available to later backend requests. citeturn1search0turn1search1

The follow-up issue affects versions through 1.2.13 and is fixed in 1.2.14.

The updated advisory assigns the cached-output issue a CVSS score of 4.5 (Medium). citeturn1search0

This development is important for administrators because simply upgrading to 1.2.13 is no longer sufficient to address the complete sequence of related custom-style security issues.

Version 1.2.14 Provides the Additional Fix

Winter CMS released version 1.2.14 to address the cached-output problem.

The newer fix applies sanitization when cached CSS is read back, including cached content that may have been generated before the update. citeturn1search0

The advisory also states that clearing the application cache can remove an already-poisoned cache entry, but clearing the cache alone is not a permanent solution because an unsafe entry could be recreated unless the underlying patch is applied. citeturn1search0

For administrators, the practical recommendation is therefore to upgrade to 1.2.14 or later, rather than stopping at 1.2.13.

Related Winter CMS Vulnerability

The original CVE is also closely related to CVE-2026-32258, which concerns a similar custom-style rendering issue in the Editor Settings functionality.

The follow-up advisory covers both Brand Settings and Editor Settings custom styles and explains that the same caching behavior affected both rendering paths. citeturn1search0

The affected permissions include:

• backend.manage_branding
• backend.manage_editor

Winter CMS recommends limiting these permissions to trusted administrators and developers. citeturn1search0

Affected Versions

The original advisory lists versions 1.2.12 and earlier as affected and version 1.2.13 as the initial fix. The later advisory expands the affected range for the cached-output issue to include 1.2.13, with 1.2.14 as the fixed version. citeturn0search1turn1search0

Security Impact

Stored XSS in an administrative interface can have consequences beyond a normal website comment or content field because backend users may have elevated privileges.

Depending on the victim's permissions and the application's configuration, successful exploitation could potentially allow malicious script execution in the victim's browser context and unauthorized actions performed through that session.

The practical risk is strongly influenced by Winter CMS's permission model. An attacker needs access to a backend account with the relevant customization permission before being able to introduce the malicious content.

This makes permission management an important part of the defense.

What Administrators Should Do

Administrators running Winter CMS should:

1. Upgrade to version 1.2.14 or later.
2. Review accounts assigned the backend.manage_branding permission.
3. Review accounts assigned the backend.manage_editor permission.
4. Remove unnecessary customization permissions from untrusted accounts.
5. Review recent changes to Brand Settings and Editor Settings.
6. Review backend activity for unexpected administrative changes.
7. Clear application caches as part of incident response when appropriate, but do not rely on cache clearing as a replacement for the security update.
8. Keep Winter CMS and its backend modules updated to current supported releases.

The Winter CMS advisory explicitly recommends restricting the relevant permissions to trusted administrators and developers. citeturn1search0

Why the Follow-Up Matters

CVE-2026-32257 is notable not only because of the original stored XSS vulnerability, but also because its initial remediation required a follow-up correction.

The sequence demonstrates an important security lesson: fixing the point where unsafe data is generated does not always guarantee that previously generated or cached data is safe.

In this case, the initial 1.2.13 fix sanitized the output path but did not fully account for the lifetime of cached compiler output. The later 1.2.14 update addressed that additional path. citeturn1search0

For defenders, this means vulnerability remediation should be verified against the complete data flow, including caching and other layers that may retain previously generated content.

Conclusion

CVE-2026-32257 is a stored XSS vulnerability affecting Winter CMS's backend Brand Settings custom styles functionality.

The original vulnerability affected versions through 1.2.12 and was initially fixed in 1.2.13. A later Winter CMS advisory disclosed that the first remediation did not fully address cached compiler output, resulting in a related issue affecting versions through 1.2.13.

Winter CMS subsequently released version 1.2.14, which addresses the cached-output problem and is the release administrators should use when securing affected installations. citeturn1search0

The vulnerability requires a backend account with specific administrative permissions, so it should not be described as a direct unauthenticated remote compromise. Nevertheless, organizations should review who has access to backend customization features and ensure that affected installations are running a current patched release.

Sources

• CVE Record — CVE-2026-32257: https://www.cve.org/CVERecord?id=CVE-2026-32257
• Winter CMS Advisory — CVE-2026-32257: https://github.com/wintercms/winter/security/advisories/GHSA-v7cf-8gh9-gxmj
• Winter CMS Follow-Up Advisory: https://github.com/wintercms/winter/security/advisories/GHSA-5cwr-5jxg-pcf6
• Winter CMS 1.2.14 Patch: https://github.com/wintercms/winter/commit/c95d780ab54f3a3f74a94ae1667bf12b3c549d5d