Wolf CMS through version 0.8.3.1 contains a remote code execution vulnerability in the FileManagerController component. The flaw stems from missing file extension validation in the create_file() and save() functions, allowing authenticated attackers to create arbitrary PHP files. Attackers possessing the file_manager_mkfile capability can write malicious PHP content directly into the web-accessible FILES_DIR directory. Once written, the malicious file can be executed by simply requesting it over HTTP, resulting in full remote code execution. The vulnerability requires authentication but no elevated administrative privileges beyond the file manager capability. This affects all versions of Wolf CMS up to and including 0.8.3.1. A proof-of-concept advisory has been published on GitHub, and VulnCheck has also documented the issue.