CVE-2026-92247CWE-284CWE-434broken-access-controlunrestricted-file-upload

CVE-2026-92247

Medium · published September 16, 2026

CVSS v3.1
4.7
EPSS
0%
Percentile
32.6
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.3.5 is able to mitigate this issue. It is suggested to upgrade the affected component.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00396 · 32.6th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-09-16T07:17Z
References (6)
https://github.com/d1n3sh-0x3/synaptikcms-security-research · [email protected]https://github.com/synaptikcms/synaptik-cms/releases/tag/v1.3.5 · [email protected]https://vuldb.com/cve/CVE-2026-92247 · [email protected]https://vuldb.com/submit/934183 · [email protected]https://vuldb.com/vuln/404682 · [email protected]https://vuldb.com/vuln/404682/cti · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 16 SEP 02:45Z
    synaptikcms synaptik-cms Admin File Manager file-manager.php rename unrestricted upload
    cvelistv5