| शीर्षक | SynaptikCMS 1.3.4.4 remote code execution+path traversal |
|---|
| विवरण | Unrestricted file upload / path traversal in the Admin File Manager (admin/file-manager.php) in SynaptikCMS v1.3.4.4. The rename function does not validate the target extension, letting an authenticated File Manager user rename an innocuously-uploaded file to an executable type (e.g. .php). Combined with the move function, which lacks path-containment checks, the file can be placed in a script-executable directory, resulting in remote code execution depending on server configuration. Fixed in v1.3.6.
Structured fields:
Vendor: SynaptikCMS
Product: SynaptikCMS
Affected: v1.3.4.4 (confirm lower bound if earlier versions affected)
Fixed: v1.3.6 (verify exact fix commit — see note above)
Component: Admin File Manager
File: admin/file-manager.php
Class: CWE-434 (rename bypasses extension validation)
CWE-22 (move lacks path containment)
CVSS v3.1: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (9.1)
→ use PR:L (9.9) if any authenticated user, not admin-only
References:
Vendor repo: https://github.com/synaptikcms/synaptik-cms
Patched release: https://github.com/synaptikcms/synaptik-cms/releases/tag/v1.3.6
Fix commit: <add the file-manager.php diff commit>
PoC / advisory: https://github.com/d1n3sh-0x3/synaptikcms-security-research
Timeline:
Reported: 2026-08-13
Vendor confirmed: 2026-08-13
Patch released: 2026-08-16
Public disclosure: 2026-08-16 |
|---|
| स्रोत | ⚠️ https://github.com/d1n3sh-0x3/synaptikcms-security-research |
|---|
| उपयोगकर्ता | Dinesh_goud (UID 98992) |
|---|
| सबमिशन | 17/08/2026 05:32 PM (1 महीना पहले) |
|---|
| संयम | 15/09/2026 10:32 PM (29 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 404682 [synaptikcms synaptik-cms तक 1.3.4.4 Admin File Manager admin/file-manager.php rename अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|