CVE-2023-52085

mediumpriority · track · 33EPSS 0.302 · 98 %ileEUUS

grimoire priorityP1 · Urgent

Exploitable?

—

no known exploitation

Likely / severe?

30.2% (98th) EPSS

CVSS 5.4 · medium

Is it mine?

4 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · scored 2026-10-27

Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.

cvss

Technical severity, 0–10. One row per scoring source.

5.4

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.3–5.4

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 2.5

v3.13.3lowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:Nsecondary · ENISA EU

v3.13.3lowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:Nsecondary · security-advisories@github.comexploitability 0.7 · impact 2.5

v3.13.3lowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:Nsecondary · OSV

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:Fsecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-22USCWE-22US

affected products (4)

Products and version ranges known to be affected.

wintercms winterall versionsenisa_euvdEU
wintercms winter≤ < 1.2.4enisa_euvdEU
wintercms winter< 1.2.4nvdUScpe:2.3:a:wintercms:winter:*:*:*:*:*:*:*:*
Packagist winter/wn-backend-module< 1.2.4osvUSpkg:composer/winter/wn-backend-module

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-2x7r-93ww-cxrqWinter CMS Local File Inclusion through Server Side Template Injection 2024-01-02ghsa · osvUS
### Impact Users with access to backend forms that include a [ColorPicker FormWidget](https://wintercms.com/docs/v1.2/docs/backend/forms#color-picker) can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. By default, only the Brand Settings (backend.manage_branding) and Mail Brand Settings (system.manage_mail_templates) forms both include the colorpicker formwidget and pass the provided value to be compiled in LESS, however it is also common for themes to include it on their Theme Customization (cms.manage_theme_options) form and it is technically possible for the values on that form to also be used in LESS compilation: https://wintercms.com/docs/v1.2/docs/themes/development#asset-compiler-variables. ### Patches This issue has been patched in v1.2.4. ### Workarounds Apply https://github.com/wintercms/winter/commit/5bc9257fe2bc47d8b786a1b1bf96bafad23d8ddd manually if unable to upgrade to v1.2.4.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

published 2023-12-29modified 2026-06-17

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan