Unrated

Local File Inclusion in Winter CMS LESS Compilation

IdentifiersCVE-2026-63179CWE-98

CVE-2026-63179 is a local file inclusion vulnerability in Winter CMS arising from LESS compilation used by customizable backend stylesheets and theme assets. Authenticated backend users with relevant permissions can inject malicious @import directives into controllable stylesheet inputs, causing the LESS processor to resolve and include arbitrary local files readable by the PHP process. The issue affects backend customization paths including custom CSS and HTML custom style settings, where user-supplied stylesheet content reaches import-capable compilation sinks without sufficient restriction on import roots. Winter core and Winter Storm version 1.2.13 address the issue by introducing a safe LESS import resolver and by restricting or disabling unsafe import behavior in affected code paths.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows disclosure of arbitrary local files accessible to the web server or PHP runtime. This can expose highly sensitive application material such as environment configuration, cryptographic secrets including the application key, and database credentials. Depending on deployment, the resulting information disclosure can enable follow-on compromise such as unauthorized database access, decryption or forgery of application data protected by exposed secrets, and broader application takeover.

Mitigation

If you can’t patch tonight, do this now.

Until a full fix is deployed, restrict access to backend asset-management capabilities to fully trusted administrators only. Remove the cms.manage_assets permission from non-trusted roles, and clear any non-empty values from the Brand Settings custom_css and Editor Settings html_custom_styles fields to eliminate attacker-controlled import sources. Additional defensive measures include reviewing backend roles for least privilege and limiting filesystem readability of sensitive files by the PHP process where operationally feasible.

Remediation

Patch, then assume compromise.

Upgrade Winter core and Winter Storm to version 1.2.13 or later. The fixed release introduces a safe LESS import resolver and updates affected compilation sinks so imports are limited to approved roots or disabled where not required. If immediate upgrading is not possible, manually apply the vendor fixes corresponding to Winter Storm and Winter core to enforce safe import resolution in all affected LESS compilation paths.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity