CVE-2015-6567
HighSummary
Wolf CMS versions before 0.8.3.1 allow unrestricted file upload and PHP Code Execution due to improper validation of the 'filename' parameter in the file manager module. Exploitation requires a registered user with upload access.
Risk Assessment
The organization may be exposed to malware and unauthorized access, potentially leading to data loss or privacy breaches.
Recommendation
It is recommended to update Wolf CMS to version 0.8.3.1 or later and implement additional security measures, such as restricting access to file upload functionality.
Other vulnerabilities in Wolf CMS
See all- CVE-2015-6568High
Wolf CMS before 0.8.3.1 allows unrestricted file rename and PHP Code Execution because the file manager does not prevent a change of a file extension to '.php' after originally using the parameter 'filename' for uploading a JPEG image. Exploitation requires a registered user who has access to upload functionality.
- CVE-2026-67207High
Wolf CMS through version 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController due to a PHP operator precedence flaw in the permission check expression. Authenticated non-administrative users can exploit the incorrect evaluation of the access control expression to create, download, and restore backups without administrative privileges.
- CVE-2026-67206High
Wolf CMS through version 0.8.3.1 contains a remote code execution vulnerability in FileManagerController. Authenticated attackers can create arbitrary PHP files by exploiting missing file extension validation in the create_file() and save() functions. Attackers with the file_manager_mkfile capability can write malicious PHP content into the web-accessible FILES_DIR directory and trigger execution by requesting the file over HTTP.
Original NVD description (English source)
Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the filemanager) does not validate the parameter "filename" properly. Exploitation requires a registered user who has access to upload functionality.