Authenticated Remote Code Execution in Wolf CMS

Wolf CMS versions 0.8.3.1 and earlier contain a critical remote code execution (RCE) vulnerability (CVE-2026-67206) residing within the FileManagerController. The vulnerability stems from improper validation of file extensions in the create_file() and save() functions. An attacker who has authenticated to the CMS and possesses the file_manager_mkfile capability can exploit this flaw to create and upload arbitrary PHP files into the web-accessible FILES_DIR directory. Once the file is uploaded, an attacker can trigger remote code execution by sending an HTTP request directly to the newly created file. This vulnerability poses a significant risk to organizations using Wolf CMS, as it effectively elevates the access of a standard CMS user to full system code execution.

Attack Chain

1. Attacker authenticates to the Wolf CMS administrative interface using valid, potentially compromised, credentials.
2. Attacker verifies they possess the file_manager_mkfile capability within the application.
3. Attacker navigates to the File Manager module within the administrative dashboard.
4. Attacker invokes the create_file() or save() function to create a new file, providing a malicious payload formatted as PHP code.
5. Attacker bypasses the missing server-side extension validation, ensuring the file is saved with a .php extension in the FILES_DIR directory.
6. Application writes the attacker-supplied PHP content to the server disk at the specified path.
7. Attacker triggers the execution of the malicious script by navigating to the file path via a standard browser HTTP request.
8. Web server executes the PHP payload, resulting in remote code execution under the context of the web server user.

Impact

Successful exploitation of this vulnerability allows an authenticated attacker to achieve remote code execution on the underlying web server. This can lead to full compromise of the web application, potential lateral movement within the hosting environment, and exfiltration of sensitive configuration or database information. Given the nature of the application, this flaw is particularly dangerous for small-to-medium organizations relying on Wolf CMS for content management.

Recommendation

1. Immediately audit user roles and capabilities in Wolf CMS to identify accounts with the file_manager_mkfile privilege; restrict this access to trusted administrators only.
2. Monitor web server logs for suspicious requests to files created within the FILES_DIR path, particularly those ending in .php.
3. Deploy the provided Sigma rule to detect POST requests to the FileManagerController that coincide with file creation events.
4. Review the Wolf CMS GitHub repository for updates and patch to a version beyond 0.8.3.1 immediately once available.