SynaptikCMS 1.3.6 — Security, Speed, and a Few Good Fixes
Version 1.3.6 is out. This one is focused on two things: making the CMS more secure, and making the admin faster. Here's what changed.
A serious security pass
This release went through an in-depth external security review, and the results are reflected throughout the codebase. Uploaded archives, whether you're installing a theme, a plugin, or restoring a backup, are now thoroughly validated before anything is extracted. Automatic extension updates follow the same rules and are restricted to trusted sources only.
Output escaping has been hardened across the entire admin panel, and all third-party libraries now include integrity verification so the CMS can detect if an external file has been tampered with.
Several smaller issues were also addressed: a misconfigured plugin folder could expose its contents on some server setups, a theme could misdirect the CMS to load the wrong file, and an edge case in the file cache has been closed. All fixed.
The admin content list becomes even faster
On larger sites, this optimizatoin enables the articles list to load instantly regardless of how much content you have.
A few other fixes
The Markdown editor had a bug where "open in new tab" links weren't working. The admin sidebar was compressing awkwardly when a lot of items were visible at once. And llms.txt was returning a 403 error on Apache — that's fixed too.
Nginx users
If you're running SynaptikCMS on nginx, this release ships a sample configuration file (nginx.conf.example) covering everything you need: routing, security headers, sensitive directory protection, and static asset caching.
Update now
As always, you can update in one click from your admin panel's Dashboard.