GHSA-2223-f22x-24cq: Winter Local File Inclusion Through =include Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2223-f22x-24cq",
  "modified" : "2026-08-20T18:44:17Z",
  "published" : "2026-08-20T18:44:17Z",
  "aliases" : [ ],
  "summary" : "Winter: Local File Inclusion through =include directives in JavaScript asset compilation",
  "details" : "### Impact\n\nAffected versions of Winter CMS allow authenticated backend users with the `cms.manage_assets` permission (\"Manage website assets - images, JavaScript files, CSS files\") to disclose arbitrary files readable by the PHP process by placing an `=include` / `=require` directive in a theme JavaScript asset.\n\n`Winter\\Storm\\Parse\\Assetic\\Filter\\JavascriptImporter` processes `=include` / `=require` directives found in comment blocks of JavaScript assets passed through `System\\Classes\\CombineAssets`. The directive target was resolved relative to the including file's own directory with `realpath()` and inlined into the combined output with no confinement check, so a directive such as `=include ../../../.env` escaped the theme's asset tree and inlined an arbitrary server-readable file. The only restriction was that the target had to have a file extension, since extension-less names had `.js` appended to them.\n\nBecause the combined output is served through the `combine/{file}` route, which performs no authentication or authorization checks, the disclosed contents then became readable by **unauthenticated** visitors at a stable URL as soon as the asset was referenced by any template.\n\nThe leaked content includes any file the web process can read, most importantly the application `.env` file (disclosing `APP_KEY` and database credentials). Text files were disclosed intact; binary content was mangled by the minification pipeline.\n\nThis is the JavaScript-importer counterpart of GHSA-58fp-mcx6-7qf9 (Local File Inclusion through LESS `@import` directives) and of CVE-2023-52085 / GHSA-2x7r-93ww-cxrq — the same vulnerability class reached through a different asset combiner filter.\n\nTo actively exploit this issue, an attacker would need an authenticated backend account with the `cms.manage_assets` permission. By default this permission is assigned to the built-in Developer role. The Winter CMS maintainers strongly recommend that the `cms.manage_assets` permission only be reserved to trusted administrators and developers in general, as it grants direct write access to files that are combined and served publicly.\n\n### Patches\n\n`JavascriptImporter` in [Winter Storm](https://github.com/wintercms/storm) now applies two independent gates to every `=include` / `=require` target:\n\n1. Only `.js` targets may be inlined. Any other extension is rejected before path resolution, which neutralises disclosure of non-JavaScript server files such as `.env`, `.php`, and `.log`. Extension-less includes are unaffected, as they are resolved to `.js` before this check, exactly as before.\n2. The resolved path must lie within the including file's own directory subtree or one of the caller-configured allowed import roots, enforced through the new `PathResolver::withinAny()` helper. A rejected include emits a comment in place of the file contents (or throws, if the directive was `=require`).\n\nThe allowed-roots configuration is now shared between the JavaScript importer and the LESS compiler through a `HasAllowedImportRoots` trait, and `System\\Classes\\CombineAssets` configures both — along with the CSS `@import` filter, using the import validator added in `assetic/framework` v3.2.1 — with `themes_path()`, `plugins_path()`, and `base_path('modules')` as the allowed roots. This preserves the cross-tree imports that shipped themes and plugins legitimately use (e.g. a plugin asset importing a module asset) while confining everything else.\n\nThe backend permission descriptions for `cms.manage_assets` and `cms.manage_content` now also carry the same \"should only be given to trusted users\" warning that was already displayed for `cms.manage_pages`, `cms.manage_layouts`, and `cms.manage_partials`.\n\nThis security issue has been fixed in [v1.2.13](https://github.com/wintercms/winter/commit/e09c8d3526f3583cb6c3476a021b885088ecd4bd) (Winter core) and [v1.2.13](https://github.com/wintercms/storm/commit/fd673f4f32140c97c68b1ed705764b819747fbdf) (Winter Storm).\n\n### Workarounds\n\nIf you cannot upgrade, apply https://github.com/wintercms/storm/commit/fd673f4f32140c97c68b1ed705764b819747fbdf and https://github.com/wintercms/winter/commit/e09c8d3526f3583cb6c3476a021b885088ecd4bd manually. As an interim mitigation, remove the `cms.manage_assets` permission from any role that is not held by a fully trusted administrator or developer, and audit existing theme `.js` assets for `=include` / `=require` directives that resolve outside the theme's own asset directory.\n\n### References\n\n- https://github.com/wintercms/winter/security/advisories/GHSA-58fp-mcx6-7qf9 — the LESS `@import` counterpart of this issue, which shares the same root cause and hardening approach.\n- https://github.com/wintercms/winter/security/advisories/GHSA-2x7r-93ww-cxrq (CVE-2023-52085) — earlier Local File Inclusion through LESS compilation.\n\nCredit to Zyad Mohamed Elmahy ([@elmahy111](https://github.com/elmahy111)) for reporting the issue.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n- Email us at [hello@wintercms.com](mailto:hello@wintercms.com)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "winter/wn-system-module"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.2.13"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/wintercms/winter/security/advisories/GHSA-2223-f22x-24cq"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/wintercms/storm/commit/fd673f4f32140c97c68b1ed705764b819747fbdf"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/wintercms/winter/commit/e09c8d3526f3583cb6c3476a021b885088ecd4bd"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/wintercms/winter"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/wintercms/winter/releases/tag/v1.2.13"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200", "CWE-22" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-20T18:44:17Z",
    "nvd_published_at" : null
  }
}