CVE-2026-67206 Details

A remote code execution vulnerability has been identified in Wolf CMS versions through 0.8.3.1, specifically within the FileManagerController of the FileManager plugin. This vulnerability allows authenticated attackers with the file_manager_mkfile capability to create arbitrary PHP files. The issue arises from inadequate validation of file extensions in the create_file() and save() functions. Exploitation involves writing malicious PHP code into the publicly accessible FILES_DIR directory, which is then executed when the file is accessed via HTTP.

Users are advised to update to a version of Wolf CMS that addresses this vulnerability. Additionally, implement file extension validation to reject executable file types, store uploaded files outside the web document root, and disable PHP execution in upload directories.