d1n3sh-0x3/cve-2026-92247Python PoC for CVE-2026-92247, an authenticated RCE in SynaptikCMS file manager via PHP upload and rename validation bypass.
SynaptikCMS File Manager Authenticated Remote Code Execution
SynaptikCMS's file manager allows an authenticated attacker to upload a file and subsequently rename it to a PHP file. This upload and rename behavior can be abused to place executable PHP code in a web-accessible location, resulting in remote code execution in the context of the web server.
Researcher: D1n3sh
/admin/file-manager.php
The vulnerable functionality involves file upload and file rename operations.
The exploit requires an authenticated administrative session.
The PoC accepts an administrator session cookie and interacts with the file manager endpoint. The supplied exploit uses the following endpoint:
/admin/file-manager.php
The exploit chain documented in the PoC is:
.php filename.The uploaded PoC implements this sequence directly.
The PoC is provided in:
synaptik_rce.py
The script creates a PHP payload and uploads it using a non-PHP filename before attempting to rename it to a PHP filename.
python3 synaptik_rce.py \
-u https://TARGET \
-c 'ADMIN_SESSION_COOKIE'
For authorised testing only.
The PoC also supports proxying traffic through an HTTP proxy and cleanup after testing.
Successful exploitation can allow an authenticated attacker to execute arbitrary operating-system commands with the privileges of the web server process.
Depending on the server configuration and privileges of the application process, this may result in:
The vulnerability was responsibly disclosed to the SynaptikCMS project.
The issue was subsequently patched by the project maintainers, and the researcher was credited in the SynaptikCMS Security Hall of Fame.
This proof of concept is provided for security research and authorised testing only.
Do not use this PoC against systems without explicit permission from the system owner.