Synology DiskStation Manager (DSM) vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Synology DiskStation Manager (DSM): 23 record(s), with affected versions and fixes.
CVE-2026-6205
High · 8.1
CWE-73 Sep 18, 2026
An external control of file name or path vulnerability in Upload API in Synology…
An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks.
CVE-2026-4036
Medium · 6.5
CWE-89 Sep 18, 2026
SQL Injection in Synology DiskStation Manager (DSM)
An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files.
CVE-2026-40539
High · 7.1
CWE-295 Sep 18, 2026
Improper Certificate Validation in Synology DiskStation Manager (DSM)
An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denial-of-service attacks.
CVE-2026-40538
Low · 3.7
CWE-307 Sep 18, 2026
Improper Restriction of Excessive Authentication Attempts in Synology DiskStation Manager (DSM)
An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks.
CVE-2026-40537
Medium · 4.3
CWE-918 Sep 18, 2026
Server-Side Request Forgery (SSRF) in Synology DiskStation Manager (DSM)
A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information.
CVE-2026-40536
Medium · 4.3
CWE-22 Sep 18, 2026
Path Traversal in Synology DiskStation Manager (DSM)
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information.
CVE-2026-40535
Medium · 6.5
CWE-22 Sep 18, 2026
Path Traversal in Synology DiskStation Manager (DSM)
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write limited files and conduct limited denial-of-service attacks.
CVE-2026-40534
Medium · 5.4
CWE-79 Sep 18, 2026
Cross-site Scripting (XSS) in Synology DiskStation Manager (DSM)
An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write limited files when the player is launched.
CVE-2026-40533
Medium · 5.3
CWE-202 Sep 18, 2026
An exposure of sensitive information through data queries vulnerability in Desktop API…
An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to obtain non-sensitive information.
CVE-2026-40532
Medium · 6.5
CWE-425 Sep 18, 2026
A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology…
A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information.
CVE-2026-40531
Medium · 4.3
CWE-190 Sep 18, 2026
Integer Overflow or Wraparound in Synology DiskStation Manager (DSM)
An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to conduct limited denial-of-service attacks.
CVE-2026-40530
High · 8.0
CWE-93 Sep 18, 2026
An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User…
An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks after the system is rebooted.
CVE-2026-13684
Critical · 9.8
CWE-116 Sep 18, 2026
Improper Encoding or Escaping of Output in Synology DiskStation Manager (DSM)
An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
CVE-2026-13683
Low · 2.7
CWE-89 Sep 18, 2026
SQL Injection in Synology DiskStation Manager (DSM)
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to obtain non-sensitive information.
CVE-2026-13673
High · 8.8
CWE-732 Sep 18, 2026
Incorrect Permission Assignment for Critical Resource in Synology DiskStation Manager (DSM)
An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks.
CVE-2026-13666
Low · 3.5
CWE-93 Sep 18, 2026
An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing…
An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write limited files when a victim clicks a sharing URL.
CVE-2026-13639
Critical · 9.8
CWE-331 Sep 18, 2026
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager…
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
CVE-2026-13635
Medium · 5.3
CWE-116 Sep 18, 2026
Improper Encoding or Escaping of Output in Synology DiskStation Manager (DSM)
An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information.
CVE-2026-13623
Medium · 4.8
CWE-79 Sep 18, 2026
Cross-site Scripting (XSS) in Synology DiskStation Manager (DSM)
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write limited files.
CVE-2025-13392
Critical · 9.8
CWE-754 May 27, 2026
Improper Check for Unusual or Exceptional Conditions in Synology Diskstation Manager
Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote attackers to bypass authentication with prior knowledge of the distinguished name (DN).
CVE-2024-5401
High · 8.8
CWE-913 Dec 4, 2025
Improper Control of Dynamically-Managed Code Resources in Synology Diskstation Manager
Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.
CVE-2024-45539
High · 7.5
CWE-787 Dec 4, 2025
Out-of-bounds Write in Synology Diskstation Manager
Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to conduct denial-of-service attacks via unspecified vectors.
CVE-2024-45538
Critical · 9.6
CWE-352 Dec 4, 2025
Cross-Site Request Forgery (CSRF) in Synology Diskstation Manager
Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors.