GHSA-m7jc-g4rc-jmvh

Suggest an improvement
Source
https://github.com/advisories/GHSA-m7jc-g4rc-jmvh
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-m7jc-g4rc-jmvh/GHSA-m7jc-g4rc-jmvh.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-m7jc-g4rc-jmvh
Aliases
Published
2026-08-12T14:41:13Z
Modified
2026-08-12T14:56:06Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax
Details

Impact

The Backend Filter widget (Backend\Widgets\Filter) is vulnerable to SQL injection through the numberrange scope type when the scope is configured with a conditions key. An authenticated backend user with access to a list view containing a vulnerable filter scope can inject arbitrary SQL via the filter's AJAX handler, potentially gaining read access to the full database contents.

To exploit this, an attacker must have a valid backend account with access to a list view where a third-party plugin has registered a numberrange filter scope using the conditions configuration key. No built-in Winter CMS backend views use this scope type and configuration combination, so a vanilla installation without plugins is not exploitable.

Patches

This issue has been fixed in Winter CMS v1.2.13.

Workarounds

If users cannot upgrade, they may apply commit https://github.com/wintercms/winter/commit/50713de95adf5298536d93f4d999652525d36d43 to your Winter CMS installation manually to resolve this issue.

Database specific 
{
    "cwe_ids":  [
        "CWE-89"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-12T14:41:13Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

Packagist / winter/wn-backend-module

Package

Name
winter/wn-backend-module
Purl
pkg:composer/winter/wn-backend-module

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.2.13

Affected versions

v1.*
v1.0.473
v1.0.474
v1.0.475
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v1.1.10
v1.1.11
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.2.6
v1.2.7
v1.2.8
v1.2.9
v1.2.10
v1.2.11
v1.2.12

Database specific

last_known_affected_version_range 
"<= 1.2.12"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-m7jc-g4rc-jmvh/GHSA-m7jc-g4rc-jmvh.json"