CVE-2026-67206

Name of the Vulnerable Software and Affected Versions Wolf CMS versions prior to 0.8.3.2

Description An issue in the FileManagerController allows authenticated attackers with the file manager mkfile capability to achieve remote code execution. This is possible due to missing file extension validation in the create file() and save() functions, enabling the creation of arbitrary PHP files within the web-accessible FILES DIR directory. Execution is triggered by requesting the created file over HTTP.

Recommendations Update Wolf CMS to version 0.8.3.2 or later. As a temporary mitigation, restrict the file manager mkfile capability to trusted users only.