| Titel | SynaptikCMS 1.3.4.4 remote code execution+path traversal |
|---|
| Beschreibung | Unrestricted file upload / path traversal in the Admin File Manager (admin/file-manager.php) in SynaptikCMS v1.3.4.4. The rename function does not validate the target extension, letting an authenticated File Manager user rename an innocuously-uploaded file to an executable type (e.g. .php). Combined with the move function, which lacks path-containment checks, the file can be placed in a script-executable directory, resulting in remote code execution depending on server configuration. Fixed in v1.3.6.
Structured fields:
Vendor: SynaptikCMS
Product: SynaptikCMS
Affected: v1.3.4.4 (confirm lower bound if earlier versions affected)
Fixed: v1.3.6 (verify exact fix commit — see note above)
Component: Admin File Manager
File: admin/file-manager.php
Class: CWE-434 (rename bypasses extension validation)
CWE-22 (move lacks path containment)
CVSS v3.1: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (9.1)
→ use PR:L (9.9) if any authenticated user, not admin-only
References:
Vendor repo: https://github.com/synaptikcms/synaptik-cms
Patched release: https://github.com/synaptikcms/synaptik-cms/releases/tag/v1.3.6
Fix commit: <add the file-manager.php diff commit>
PoC / advisory: https://github.com/d1n3sh-0x3/synaptikcms-security-research
Timeline:
Reported: 2026-08-13
Vendor confirmed: 2026-08-13
Patch released: 2026-08-16
Public disclosure: 2026-08-16 |
|---|
| Quelle | ⚠️ https://github.com/d1n3sh-0x3/synaptikcms-security-research |
|---|
| Benutzer | Dinesh_goud (UID 98992) |
|---|
| Einreichung | 17.08.2026 17:32 (vor 1 Monat) |
|---|
| Moderieren | 15.09.2026 22:32 (29 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 404682 [synaptikcms synaptik-cms bis 1.3.4.4 Admin File Manager admin/file-manager.php rename erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|