Which versions of Wolf CMS are affected by CVE-2026-67206?

Wolf CMS versions through 0.8.3.1 contain a remote code execution vulnerability allowing authenticated users with file-manager permissions to upload arbitrary PHP code and execute it on the server.

Is there a public PoC exploit available for CVE-2026-67206?

Yes, a public proof-of-concept exploit is available for CVE-2026-67206. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-67206?

Within 24 hours: Audit all Wolf CMS instances for version 0.8.3.1 or earlier; immediately restrict the file_manager_mkfile capability to fully-trusted administrative accounts only through role-based access controls. Within 7 days: Review access logs for unauthorized file uploads to the FILES_DIR; configure your web server (Apache via .htaccess or Nginx via location block) to block PHP execution in the FILES_DIR directory; implement WAF rules to reject file uploads with .php, .phtml, and other executable extensions. Within 30 days: Evaluate migration to an actively maintained CMS platform with established security update processes, or engage with Wolf CMS maintainers regarding patch development timelines and implement comprehensive application-level file-type validation as a permanent control.

Wolf CMS CVE-2026-67206

Q: What is the CVSS score of CVE-2026-67206?

CVE-2026-67206 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-51291 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-30 VulnCheck

GHSA-3pqf-wrr6-rf9m

PHP RCE File Upload Wolfcms

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable file manager, low complexity, but requires an authenticated account with the file_manager_mkfile capability so PR:L; webshell execution yields full C/I/A on the host.

3.1 AV:N/AC:L/PR:L/UI:N/S:N/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 20:51 vuln.today

CVE Published

Jul 30, 2026 - 19:27 cve.org

HIGH 8.7

DescriptionCVE.org

Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension validation in the create_file() and save() functions. Attackers with the file_manager_mkfile capability can write malicious PHP content into the web-accessible FILES_DIR directory and trigger execution by requesting the file over HTTP.

Articles & Coverage 1

anirbala98.medium.com CVE-2026-67206: High-Severity Vulnerability Analyzed from Source Code to Working Exploit Aug 05, 2026

AnalysisAI

Remote code execution in Wolf CMS through version 0.8.3.1 allows authenticated attackers holding the file_manager_mkfile capability to write arbitrary PHP files into the web-accessible FILES_DIR and execute them by requesting the file over HTTP. The flaw stems from missing file-extension validation in the FileManagerController create_file() and save() functions (CWE-434). Publicly available exploit code exists (via VulnCheck advisory), though it is not listed in CISA KEV; the CVSS 4.0 base score is 8.7 (High).

Technical ContextAI

Wolf CMS is a lightweight PHP-based content management system that provides a built-in file manager (FileManagerController) for administrators and privileged users to create and edit files within a designated FILES_DIR. This vulnerability is a classic CWE-434 (Unrestricted Upload of File with Dangerous Type): the create_file() and save() handlers accept a user-supplied filename and content but fail to validate or restrict the file extension, so a user can create a .php file rather than a benign document. Because FILES_DIR is served directly by the web server and PHP files placed there are interpreted by the PHP engine rather than served as static content, the attacker's uploaded code runs in the application's server context. The affected product per CPE is cpe:2.3:a:wolfcms:wolfcms:*:*:*:*:*:*:*:* across all versions up to and including 0.8.3.1.

RemediationAI

No vendor-released patch version is identified at time of analysis, so upgrade guidance cannot cite an exact fixed release; monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/wolf-cms-authenticated-rce-via-filemanagercontroller-file-upload) for an official fix and apply it once published. As compensating controls, revoke the file_manager_mkfile capability from all non-essential roles and restrict file-manager access to a minimal set of trusted administrators, which reduces the exploitable population at the cost of limiting legitimate content-management workflows. Configure the web server to prevent PHP execution within FILES_DIR - for example, disable the PHP handler for that directory (php_admin_flag engine off in Apache, or remove the fastcgi/php location mapping in nginx) so uploaded .php files are served as static content rather than executed; this neutralizes the code-execution path but may break any legitimate feature that relies on dynamic files in that path. Additionally, enforce an allowlist of permitted file extensions at the application or WAF layer and place the admin interface behind network restrictions or VPN to shrink the attack surface.