CVE-2026-63179

### Impact Affected versions of Winter CMS allow authenticated backend users with the following permissions to disclose arbitrary files readable by the PHP process by injecting `@import (inline) "<path>"` directives into LESS source that the backend compiles. Four entry points share the same root cause: - **Brand Settings** `BrandSetting.custom_css` field (`backend.manage_branding`) — compiled inline into every backend page's `<style>` block. - **Editor Settings** `EditorSetting.html_custom_styles` field (`backend.manage_editor`) — compiled inline into every backend page's `<style>` block. - **Mail Brand Settings** `MailBrandSetting` colour-picker fields (`system.manage_mail_templates`) — values are concatenated into LESS source via `Less_Parser::ModifyVars()` with no escaping, so any value the form validator does not reject can carry an `@import` directive. - **Theme `.less`/`.sass`/`.scss` assets** (`cms.manage_assets`) — compiled through `System\Classes\CombineAssets` when served, with the same `Less_Parser` configuration. Both absolute paths and `..` traversal escape from the asset's own tree were exploitable. The leaked content includes any file the web process can read, most importantly the application `.env` file (disclosing `APP_KEY` and database credentials). To actively exploit this issue, an attacker would need an authenticated backend account with one of the permissions listed above. By default these are assigned to the built-in Developer role. ### Patches The root cause is in the `wikimedia/less.php` integration in [Winter Storm](https://github.com/wintercms/storm): `Less_Parser` was instantiated without a safe import resolver, and its `Less_FileManager::getFilePath()` falls back to the raw attacker-supplied path when no candidate root matches. Storm now ships a `LessImportResolver` that uses the callable form of `Less_Parser::SetImportDirs()` to refuse any `@import` whose resolved path lies outside the calling context's allowed roots, defeating b