CVE-2023-52085

Deeper analysis

Winter CMS, a free open-source content management system, contains a path traversal vulnerability tracked as CVE-2023-52085 and assigned CWE-22. The flaw resides in the ColorPicker FormWidget: values supplied through backend forms are passed unprocessed into LESS stylesheet compilation, enabling local file inclusion when the resulting stylesheets are generated.

An authenticated user holding backend access sufficient to reach affected forms can supply a crafted color value that traverses the filesystem during LESS processing. Successful exploitation yields limited read and write access to arbitrary local files, though the CVSS 3.3 score reflects the high attack complexity and requirement for high privileges.

The Winter CMS project has published a security advisory (GHSA-2x7r-93ww-cxrq) and applied a fix in version 1.2.4; the corresponding patch appears in commit 5bc9257fe2bc47d8b786a1b1bf96bafad23d8ddd on the project repository. Administrators should upgrade promptly and restrict backend form access to trusted roles until patches are applied. The associated EPSS score has remained in the 0.40 range with a modest peak of 0.46 and does not indicate a pronounced post-disclosure increase in exploitation interest.