CVE-2026-67207
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Wolf CMS through version 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController due to a PHP operator precedence flaw in the permission check expression. Authenticated non-administrative users can exploit the incorrect evaluation of the access control expression to create, download, and restore backups without administrative privileges.
Risk Assessment
The risk involves unauthorized access to backup functionality, potentially leading to data leakage or system integrity compromise.
Recommendation
Update Wolf CMS to a version containing the fix or apply available security patches. If an update is not possible, restrict access to the admin panel.
Other vulnerabilities in Wolf CMS
See all- CVE-2015-6568High
Wolf CMS before 0.8.3.1 allows unrestricted file rename and PHP Code Execution because the file manager does not prevent a change of a file extension to '.php' after originally using the parameter 'filename' for uploading a JPEG image. Exploitation requires a registered user who has access to upload functionality.
- CVE-2015-6567High
Wolf CMS versions before 0.8.3.1 allow unrestricted file upload and PHP Code Execution due to improper validation of the 'filename' parameter in the file manager module. Exploitation requires a registered user with upload access.
- CVE-2026-67206High
Wolf CMS through version 0.8.3.1 contains a remote code execution vulnerability in FileManagerController. Authenticated attackers can create arbitrary PHP files by exploiting missing file extension validation in the create_file() and save() functions. Attackers with the file_manager_mkfile capability can write malicious PHP content into the web-accessible FILES_DIR directory and trigger execution by requesting the file over HTTP.
Original NVD description (English source)
Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access restricted backup functionality due to a PHP operator precedence flaw in the permission check expression. Attackers can exploit the incorrect evaluation of the access control expression to create, download, and restore backups without administrative privileges.