Executive brief
SynaptikCMS is a content management system used to build and manage websites. An authenticated attacker with admin access can upload a file with a benign filename and then rename it to an executable PHP file, allowing them to run arbitrary code on the web server. This could lead to full compromise of the website and underlying server.
Technical details
The vulnerability is an authenticated file upload and extension validation bypass in the file manager component (/admin/file-manager.php). An attacker with valid admin credentials can upload a PHP payload disguised with a non-PHP filename, then use the rename function to change it to a .php extension, placing executable code in a web-accessible directory. The attack requires authentication and valid admin session credentials. Successful exploitation results in remote code execution with the privileges of the web server process, potentially leading to server compromise and data exfiltration. The vulnerability was patched in version 1.3.5.
Affected products
- SynaptikCMS Synaptik CMS up to 1.3.4.4
Timeline
- 2026-08-13: disclosed: Public disclosure with proof of concept
- 2026-08-14: patched: Version 1.3.5 released with fix
- 2026-09-16: advisory: CVE-2026-92247 published