THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-2223-f22x-24cq (medium) — Winter: Local File Inclusion through =include directives in JavaScript asset compilation

[GHSA] GHSA-2223-f22x-24cq (medium) — Winter: Local File Inclusion through =include directives in JavaScript asset compilation

highgithub_advisoriesPublished 2026-08-20

GHSA-2223-f22x-24cq Severity: medium CVE: None

Winter: Local File Inclusion through =include directives in JavaScript asset compilation

### Impact

Affected versions of Winter CMS allow authenticated backend users with the `cms.manage_assets` permission ("Manage website assets - images, JavaScript files, CSS files") to disclose arbitrary files readable by the PHP process by placing an `=include`

MITRE ATT&CK techniques

JavaScriptT1059.007
CredentialsT1589.001

Indicators of compromise

e09c8d3526f3583cb6c3476a021b885088ecd4bdsha1
fd673f4f32140c97c68b1ed705764b819747fbdfsha1
CVE-2023-52085cve
hello@wintercms.comemail

Original source: https://github.com/advisories/GHSA-2223-f22x-24cq