Log in Start free

Vulnerability · Published Sep 16, 2026 · Assigned by VulDB

CVE-2026-92247synaptikcms synaptik-cms Admin File Manager file-manager.php rename unrestricted upload

Medium 4.7

In plain English

A medium-severity unrestricted file upload in synaptik-cms from synaptikcms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.4%top 66.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.3.5 is able to mitigate this issue. It is suggested to upgrade the affected component.

Affected products (as reported)

VendorProductVersions
synaptikcms synaptik-cms 1.3.4.01.3.4.11.3.4.21.3.4.31.3.4.4

Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References