Wolf CMS through version 0.8.3.1 contains a remote code execution flaw in the FileManagerController. The vulnerability stems from missing validation of file extensions in the create_file() and save() functions, allowing authenticated users to upload files with an arbitrary PHP payload. Executing the malicious file via an HTTP request results in arbitrary code running with the permissions of the web server, exposing the full impact of a remote code execution weakness as defined by CWE-434.

Wolf CMS 0.8.3.1 is affected. The flaw is exposed to users possessing the file_manager_mkfile capability, which permits the creation and saving of files in the web-accessible FILES_DIR directory. No other versions or products are listed as impacted.

The CVSS score of 8.7 indicates a high severity. The EPSS score of 0.00437 (less than 1%) reflects a low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and specifically granted the file_manager_mkfile capability. Once a malicious PHP file is stored, an attacker can trigger its execution simply by accessing the file over HTTP, thereby achieving full remote code execution on the vulnerable system.