CVE-2026-67206
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Wolf CMS through version 0.8.3.1 contains a remote code execution vulnerability in FileManagerController. Authenticated attackers can create arbitrary PHP files by exploiting missing file extension validation in the create_file() and save() functions. Attackers with the file_manager_mkfile capability can write malicious PHP content into the web-accessible FILES_DIR directory and trigger execution by requesting the file over HTTP.
Risk Assessment
The risk is critical – an attacker can gain full control over the server by executing arbitrary PHP code, potentially leading to system compromise and data theft.
Recommendation
Immediately update Wolf CMS to a version containing the fix for file extension validation. If an update is not possible, disable the file creation feature for non-administrators.
Other vulnerabilities in Wolf CMS
See all- CVE-2015-6568High
Wolf CMS before 0.8.3.1 allows unrestricted file rename and PHP Code Execution because the file manager does not prevent a change of a file extension to '.php' after originally using the parameter 'filename' for uploading a JPEG image. Exploitation requires a registered user who has access to upload functionality.
- CVE-2015-6567High
Wolf CMS versions before 0.8.3.1 allow unrestricted file upload and PHP Code Execution due to improper validation of the 'filename' parameter in the file manager module. Exploitation requires a registered user with upload access.
- CVE-2026-67207High
Wolf CMS through version 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController due to a PHP operator precedence flaw in the permission check expression. Authenticated non-administrative users can exploit the incorrect evaluation of the access control expression to create, download, and restore backups without administrative privileges.
Original NVD description (English source)
Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the create_file() and save() functions. Attackers with the file_manager_mkfile capability can write malicious PHP content into the web-accessible FILES_DIR directory and trigger execution by requesting the file over HTTP.