CVE-2026-67206: Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload
Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the createfile() and save() functions. Attackers with the filemanagermkfile capability can write malicious PHP content into the web-accessible FILESDIR directory and trigger execution by requesting the file over HTTP.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67206?
CVE-2026-67206 has a high severity rating of 8.8.
How do I fix CVE-2026-67206?
To fix CVE-2026-67206, update Wolf CMS to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-67206?
CVE-2026-67206 is a remote code execution vulnerability caused by improper file extension validation.
Who is affected by CVE-2026-67206?
Authenticated users with file_manager_mkfile capability in Wolf CMS version 0.8.3.1 are affected by CVE-2026-67206.
What can attackers do with CVE-2026-67206?
Attackers can exploit CVE-2026-67206 to create arbitrary PHP files on the server, leading to potential remote code execution.