{"id":"GHSA-m7jc-g4rc-jmvh","aliases":["CVE-2026-32593"],"title":"Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax","description":"## Impact\n\nThe Backend Filter widget (`Backend\\Widgets\\Filter`) is vulnerable to SQL injection through the `numberrange` scope type when the scope is configured with a `conditions` key. An authenticated backend user with access to a list view containing a vulnerable filter scope can inject arbitrary SQL via the filter's AJAX handler, potentially gaining read access to the full database contents.\n\nTo exploit this, an attacker must have a valid backend account with access to a list view where a third-party plugin has registered a `numberrange` filter scope using the `conditions` configuration key. No built-in Winter CMS backend views use this scope type and configuration combination, so a vanilla installation without plugins is not exploitable.\n\n## Patches\n\nThis issue has been fixed in Winter CMS v1.2.13.\n\n## Workarounds\n\nIf users cannot upgrade, they may apply commit https://github.com/wintercms/winter/commit/50713de95adf5298536d93f4d999652525d36d43 to your Winter CMS\ninstallation manually to resolve this issue.","severity":"medium","score":5.9,"published":"2026-08-12T14:41:13.000Z","modified":"2026-08-12T14:56:06.567Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"winter/wn-backend-module","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.2.13"}],"type":"ECOSYSTEM"}],"versions":["v1.0.473","v1.0.474","v1.0.475","v1.1.10","v1.1.11","v1.1.2","v1.1.3","v1.1.4","v1.1.5","v1.1.6","v1.1.7","v1.1.8","v1.1.9","v1.2.0","v1.2.1","v1.2.10","v1.2.11","v1.2.12","v1.2.2","v1.2.3","v1.2.4","v1.2.5","v1.2.6","v1.2.7","v1.2.8","v1.2.9"],"fixed":["1.2.13"]}],"references":["https://github.com/wintercms/winter/security/advisories/GHSA-m7jc-g4rc-jmvh","https://github.com/wintercms/winter/commit/50713de95adf5298536d93f4d999652525d36d43","https://github.com/wintercms/winter"],"sources":[{"name":"OSV","id":"GHSA-m7jc-g4rc-jmvh","modified":"2026-08-12T14:56:06.567625Z","url":"https://osv.dev/vulnerability/GHSA-m7jc-g4rc-jmvh"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","score":5.9}]}