VYPR
← All advisories
Low severityNVD Advisory· Published Dec 28, 2023· Updated Aug 2, 2024

Stored XSS through privileged upload of Media Manager file followed by renaming

CVE-2023-52083

Description

Winter is a free, open-source content management system. Prior to 1.2.4, users with the media.manage_media permission can upload files to the Media Manager and rename them after uploading. Previously, media manager files were only sanitized on upload, not on renaming, which could have allowed a stored XSS attack. This issue has been patched in v1.2.4.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
winter/wn-system-modulePackagist
< 1.2.41.2.4

Affected products

1

Patches

1
2969daeea8de

Improve detection of renames to SVG

https://github.com/wintercms/winterLuke TowersNov 30, 2023via ghsa
commit
1 file changed · +1 −1
  • modules/system/classes/MediaLibrary.php+1 −1 modified
    @@ -351,7 +351,7 @@ public function moveFile($oldPath, $newPath, $isRename = false)
         // If the file extension is changed to SVG, ensure that it has been sanitized
         $oldExt = pathinfo($oldPath, PATHINFO_EXTENSION);
         $newExt = pathinfo($newPath, PATHINFO_EXTENSION);
-        if ($oldExt !== $newExt && $newExt === 'svg') {
+        if ($oldExt !== $newExt && strtolower($newExt) === 'svg') {
             $contents = $this->getStorageDisk()->get($fullOldPath);
             $contents = Svg::sanitize($contents);
             $this->getStorageDisk()->put($fullOldPath, $contents);

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.