High CVSS 8.8
CVE-2026-67206
Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the create_file() and save() functions. Attackers with the file_manager_mkfile capability can write malicious PHP content into the web-accessible FILES_DIR directory and trigger execution by requesting the file over HTTP.
What this means
- Exposure
- Exploitable remotely over the network, with an ordinary user account and with no action from the victim.
- Impact
- An attacker can read sensitive data, modify or destroy data and take the service offline.
- Weakness
- Upload accepts a dangerous file type, often one the server will execute.
- Likelihood
- Its EPSS score puts short-term exploitation in a middle band: neither negligible nor imminent.
What to doFold into the next patch cycle.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.