| tiêu đề | SynaptikCMS 1.3.4.4 remote code execution+path traversal |
|---|
| Mô tả | Unrestricted file upload / path traversal in the Admin File Manager (admin/file-manager.php) in SynaptikCMS v1.3.4.4. The rename function does not validate the target extension, letting an authenticated File Manager user rename an innocuously-uploaded file to an executable type (e.g. .php). Combined with the move function, which lacks path-containment checks, the file can be placed in a script-executable directory, resulting in remote code execution depending on server configuration. Fixed in v1.3.6.
Structured fields:
Vendor: SynaptikCMS
Product: SynaptikCMS
Affected: v1.3.4.4 (confirm lower bound if earlier versions affected)
Fixed: v1.3.6 (verify exact fix commit — see note above)
Component: Admin File Manager
File: admin/file-manager.php
Class: CWE-434 (rename bypasses extension validation)
CWE-22 (move lacks path containment)
CVSS v3.1: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (9.1)
→ use PR:L (9.9) if any authenticated user, not admin-only
References:
Vendor repo: https://github.com/synaptikcms/synaptik-cms
Patched release: https://github.com/synaptikcms/synaptik-cms/releases/tag/v1.3.6
Fix commit: <add the file-manager.php diff commit>
PoC / advisory: https://github.com/d1n3sh-0x3/synaptikcms-security-research
Timeline:
Reported: 2026-08-13
Vendor confirmed: 2026-08-13
Patch released: 2026-08-16
Public disclosure: 2026-08-16 |
|---|
| Nguồn | ⚠️ https://github.com/d1n3sh-0x3/synaptikcms-security-research |
|---|
| Người dùng | Dinesh_goud (UID 98992) |
|---|
| Đệ trình | 17/08/2026 17:32 (cách đây 30 ngày) |
|---|
| Kiểm duyệt | 15/09/2026 22:32 (29 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 404682 [synaptikcms synaptik-cms đến 1.3.4.4 Admin File Manager admin/file-manager.php rename nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|