| 标题 | SynaptikCMS 1.3.4.4 remote code execution+path traversal |
|---|
| 描述 | Unrestricted file upload / path traversal in the Admin File Manager (admin/file-manager.php) in SynaptikCMS v1.3.4.4. The rename function does not validate the target extension, letting an authenticated File Manager user rename an innocuously-uploaded file to an executable type (e.g. .php). Combined with the move function, which lacks path-containment checks, the file can be placed in a script-executable directory, resulting in remote code execution depending on server configuration. Fixed in v1.3.6.
Structured fields:
Vendor: SynaptikCMS
Product: SynaptikCMS
Affected: v1.3.4.4 (confirm lower bound if earlier versions affected)
Fixed: v1.3.6 (verify exact fix commit — see note above)
Component: Admin File Manager
File: admin/file-manager.php
Class: CWE-434 (rename bypasses extension validation)
CWE-22 (move lacks path containment)
CVSS v3.1: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (9.1)
→ use PR:L (9.9) if any authenticated user, not admin-only
References:
Vendor repo: https://github.com/synaptikcms/synaptik-cms
Patched release: https://github.com/synaptikcms/synaptik-cms/releases/tag/v1.3.6
Fix commit: <add the file-manager.php diff commit>
PoC / advisory: https://github.com/d1n3sh-0x3/synaptikcms-security-research
Timeline:
Reported: 2026-08-13
Vendor confirmed: 2026-08-13
Patch released: 2026-08-16
Public disclosure: 2026-08-16 |
|---|
| 来源 | ⚠️ https://github.com/d1n3sh-0x3/synaptikcms-security-research |
|---|
| 用户 | Dinesh_goud (UID 98992) |
|---|
| 提交 | 2026-08-17 17時32分 (30 日前) |
|---|
| 管理 | 2026-09-15 22時32分 (29 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 404682 [synaptikcms synaptik-cms 直到 1.3.4.4 Admin File Manager admin/file-manager.php rename 权限提升] |
|---|
| 积分 | 20 |
|---|