wintercms/winter
develop@ eec0c42Fixes16
CVEs24
Peak severityCritical
Commits6,276
Regression coverage20.0%
Highlights
Cross-Site Scripting: 6 prior fixes. Scrutinize any change in this area.
modules/backend/classes/Controller.php: most-fixed (2 issues). Treat as high-risk during review.
10 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
Sandbox Escape: 2 historical fix(es) link modules/system/twig/SecurityPolicy.php to Sandbox Escape.
Cross-Site Scripting: 2 historical fix(es) link modules/backend/widgets/Lists.php to Cross-Site Scripting.
Arbitrary File Access: 1 historical fix(es) link modules/system/classes/CombineAssets.php to Arbitrary File Access.
Last analyzed 6 Oct 2026, 20:46 UTC