Wolfcms
Monthly
Privilege escalation via authorization bypass in Wolf CMS (through 0.8.3.1) lets any authenticated non-administrative user reach the BackupRestoreController and create, download, and restore site backups that should be admin-only. The root cause is a PHP operator-precedence mistake in the permission-check expression, so the access control evaluates incorrectly and grants low-privileged accounts admin-tier backup functionality. Publicly available exploit code exists (published by VulnCheck), but there is no public exploit identified in CISA KEV, so active exploitation is not confirmed.
Remote code execution in Wolf CMS through version 0.8.3.1 allows authenticated attackers holding the file_manager_mkfile capability to write arbitrary PHP files into the web-accessible FILES_DIR and execute them by requesting the file over HTTP. The flaw stems from missing file-extension validation in the FileManagerController create_file() and save() functions (CWE-434). Publicly available exploit code exists (via VulnCheck advisory), though it is not listed in CISA KEV; the CVSS 4.0 base score is 8.7 (High).
Privilege escalation via authorization bypass in Wolf CMS (through 0.8.3.1) lets any authenticated non-administrative user reach the BackupRestoreController and create, download, and restore site backups that should be admin-only. The root cause is a PHP operator-precedence mistake in the permission-check expression, so the access control evaluates incorrectly and grants low-privileged accounts admin-tier backup functionality. Publicly available exploit code exists (published by VulnCheck), but there is no public exploit identified in CISA KEV, so active exploitation is not confirmed.
Remote code execution in Wolf CMS through version 0.8.3.1 allows authenticated attackers holding the file_manager_mkfile capability to write arbitrary PHP files into the web-accessible FILES_DIR and execute them by requesting the file over HTTP. The flaw stems from missing file-extension validation in the FileManagerController create_file() and save() functions (CWE-434). Publicly available exploit code exists (via VulnCheck advisory), though it is not listed in CISA KEV; the CVSS 4.0 base score is 8.7 (High).