CVE-2015-6567

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.08.8High EPSS percentile96th11% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 2 sources FixVendor fixNo build named by the sources

Published 2017-04-14Updated 2026-05-13Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Wolfcms Wolf CmsAffected: ≤ 0.8.3Upgrade to: after 0.8.3Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your website runs Wolf CMS and whether its version is earlier than 0.8.3.1.
Review which user accounts can upload files and remove upload access from accounts that do not need it.
Upgrade Wolf CMS to version 0.8.3.1 or later.
Check uploaded-file folders and web-server logs for unexpected PHP files or unfamiliar administrator activity.

Vendor advisory Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the filemanager) does not validate the parameter "filename" properly. Exploitation requires a registered user who has access to upload functionality.

In plain language

Written by AI from the record

Wolf CMS versions before 0.8.3.1 let a user with upload access place harmful code on the site, so affected small businesses should update.

Authenticated remote code execution in Wolf CMS filemanager caused by improper validation of the filename parameter during file upload.

If you're affected

Website takeover
Customer data exposure
Malicious file uploads
Service disruption
Ransomware risk

What is it

This is a flaw in the part of Wolf CMS used to upload and manage website files. It is like allowing someone with access to a building’s delivery entrance to label a dangerous package as an ordinary delivery and have it accepted inside.

Who is affected

This matters to you if you run Wolf CMS for your website and let staff, contractors, or other accounts upload files. It is only a risk if an attacker already has a registered account with access to the upload function.

How urgent is it

Public exploit code is available, so an attacker who obtains a suitable account can use a known method rather than developing one. Treat this as an amber priority: update promptly and review upload-capable accounts, although it is not listed in CISA’s catalog of vulnerabilities known to be actively exploited.

What to do — in detail

Confirm the installed Wolf CMS version from its administration area or deployment files, then identify all accounts with access to the file manager upload feature. Upgrade to Wolf CMS 0.8.3.1 or a later supported release; no separate branch-specific fixed versions are provided in the findings. Test the upgrade on a copy of the site first if your theme or plugins are old, as compatibility changes are not documented in the findings.

If upgrading is delayed, disable or restrict file uploads through the file manager, remove upload permissions from nonessential accounts, and restrict access to the administration area. Review upload directories for unexpected PHP files and review web-server and CMS logs for unusual upload activity or administrator logins. CISA has not assigned a KEV remediation due date because this CVE is not listed in KEV.

Technical context

CVE-2015-6567 is rated CVSS 8.8 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It is CWE-20 improper input validation in the filemanager filename parameter, enabling unrestricted file upload and PHP code execution for an authenticated user with upload privileges. Two public exploits are known. It is not listed in CISA KEV, so there is no finding-confirmed active exploitation; EPSS predicts a 9.0% likelihood and is flat at the 95th percentile. Vendor remediation is available in the referenced Wolf CMS commit.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

2 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

11% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

A public exploit existed 67 days before the patch.

2026-09-23EPSS band changelow → moderateepss band change
2026-09-21EPSS band changemoderate → 0epss band change
2026-09-06EPSS band change0 → moderateepss band change
2026-09-05EPSS band changemoderate → 0epss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-29EPSS band changemoderate → low

Affected products

wolfcmsoss-projectaka wolf cms
- wolf cmsOn-premWeb & CMS Plugins / cms-core

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable