PT-2026-66600 · Wolfcms · Wolf Cms

Caycon · CVE-2026-67206 · Published 2026-07-30 · Updated 2026-07-30

Mitre

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the create file() and save() functions. Attackers with the file manager mkfile capability can write malicious PHP content into the web-accessible FILES DIR directory and trigger execution by requesting the file over HTTP.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-67206

Affected Products

Wolf Cms

References · 3

• 🔥 https://github.com/Caycon/cve-advisories/blob/main/2026/WolfCms/CVE-2026-67206.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-67206 · Security Note
• https://vulncheck.com/advisories/wolf-cms-authenticated-rce-via-filemanagercontroller-file-upload · Note