Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-82x1-84ph-s7g8
Vulnerability ID VCID-82x1-84ph-s7g8
Aliases CVE-2023-52085
GHSA-2x7r-93ww-cxrq
Summary Winter CMS Local File Inclusion through Server Side Template Injection
Status Published
Exploitability 0.5
Weighted Severity 3.0
Risk 1.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.39107 https://api.first.org/data/v1/epss?cve=CVE-2023-52085
epss 0.39107 https://api.first.org/data/v1/epss?cve=CVE-2023-52085
epss 0.39738 https://api.first.org/data/v1/epss?cve=CVE-2023-52085
cvssv3.1_qr LOW https://github.com/advisories/GHSA-2x7r-93ww-cxrq
cvssv3.1 3.3 https://github.com/wintercms/winter
generic_textual LOW https://github.com/wintercms/winter
cvssv3.1 3.3 https://github.com/wintercms/winter/commit/5bc9257fe2bc47d8b786a1b1bf96bafad23d8ddd
generic_textual LOW https://github.com/wintercms/winter/commit/5bc9257fe2bc47d8b786a1b1bf96bafad23d8ddd
cvssv3.1 3.3 https://github.com/wintercms/winter/security/advisories/GHSA-2x7r-93ww-cxrq
cvssv3.1_qr LOW https://github.com/wintercms/winter/security/advisories/GHSA-2x7r-93ww-cxrq
generic_textual LOW https://github.com/wintercms/winter/security/advisories/GHSA-2x7r-93ww-cxrq
cvssv3.1 3.3 https://nvd.nist.gov/vuln/detail/CVE-2023-52085
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2023-52085
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-52085
https://github.com/wintercms/winter
https://github.com/wintercms/winter/commit/5bc9257fe2bc47d8b786a1b1bf96bafad23d8ddd
CVE-2023-52085 https://nvd.nist.gov/vuln/detail/CVE-2023-52085
GHSA-2x7r-93ww-cxrq https://github.com/advisories/GHSA-2x7r-93ww-cxrq
GHSA-2x7r-93ww-cxrq https://github.com/wintercms/winter/security/advisories/GHSA-2x7r-93ww-cxrq
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/wintercms/winter
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/wintercms/winter/commit/5bc9257fe2bc47d8b786a1b1bf96bafad23d8ddd
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/wintercms/winter/security/advisories/GHSA-2x7r-93ww-cxrq
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-52085
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.97382
EPSS Score 0.39107
Published At June 12, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T20:33:30.727094+00:00 GHSA Importer Import https://github.com/advisories/GHSA-2x7r-93ww-cxrq 38.6.0