| 제목 | SynaptikCMS 1.3.4.4 remote code execution+path traversal |
|---|
| 설명 | Unrestricted file upload / path traversal in the Admin File Manager (admin/file-manager.php) in SynaptikCMS v1.3.4.4. The rename function does not validate the target extension, letting an authenticated File Manager user rename an innocuously-uploaded file to an executable type (e.g. .php). Combined with the move function, which lacks path-containment checks, the file can be placed in a script-executable directory, resulting in remote code execution depending on server configuration. Fixed in v1.3.6.
Structured fields:
Vendor: SynaptikCMS
Product: SynaptikCMS
Affected: v1.3.4.4 (confirm lower bound if earlier versions affected)
Fixed: v1.3.6 (verify exact fix commit — see note above)
Component: Admin File Manager
File: admin/file-manager.php
Class: CWE-434 (rename bypasses extension validation)
CWE-22 (move lacks path containment)
CVSS v3.1: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (9.1)
→ use PR:L (9.9) if any authenticated user, not admin-only
References:
Vendor repo: https://github.com/synaptikcms/synaptik-cms
Patched release: https://github.com/synaptikcms/synaptik-cms/releases/tag/v1.3.6
Fix commit: <add the file-manager.php diff commit>
PoC / advisory: https://github.com/d1n3sh-0x3/synaptikcms-security-research
Timeline:
Reported: 2026-08-13
Vendor confirmed: 2026-08-13
Patch released: 2026-08-16
Public disclosure: 2026-08-16 |
|---|
| 원천 | ⚠️ https://github.com/d1n3sh-0x3/synaptikcms-security-research |
|---|
| 사용자 | Dinesh_goud (UID 98992) |
|---|
| 제출 | 2026. 08. 17. PM 05:32 (1 월 ago) |
|---|
| 모더레이션 | 2026. 09. 15. PM 10:32 (29 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 404682 [synaptikcms synaptik-cms 까지 1.3.4.4 Admin File Manager admin/file-manager.php rename 권한 상승] |
|---|
| 포인트들 | 20 |
|---|