PT-2026-66600 · Wolfcms · Wolf Cms

Caycon · CVE-2026-67206 · Publicado 2026-07-30 · Atualizado 2026-07-30

Mitre

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the create file() and save() functions. Attackers with the file manager mkfile capability can write malicious PHP content into the web-accessible FILES DIR directory and trigger execution by requesting the file over HTTP.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2026-67206

Produtos afetados

Wolf Cms

Referências · 3

• 🔥 https://github.com/Caycon/cve-advisories/blob/main/2026/WolfCms/CVE-2026-67206.md · Exploit
• https://vulncheck.com/advisories/wolf-cms-authenticated-rce-via-filemanagercontroller-file-upload · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-67206 · Nota de Segurança