Synology vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-6205 An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 aHigh 8.1 · Sep 18, 2026
• CVE-2026-40539 An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allowHigh 7.1 · Sep 18, 2026
• CVE-2026-40530 An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-728High 8 · Sep 18, 2026
• CVE-2026-13684 An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7Critical 9.8 · Sep 18, 2026
• CVE-2026-13673 An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7High 8.8 · Sep 18, 2026
• CVE-2026-13639 An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allCritical 9.8 · Sep 18, 2026
• CVE-2026-40541 An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-221Critical 9 · Aug 28, 2026
• CVE-2026-4793 An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-oHigh 7.3 · Aug 3, 2026
• CVE-2022-49042 An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows locaHigh 7.8 · Jun 3, 2026
• CVE-2022-49036 An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media CreatorHigh 7.8 · Jun 3, 2026
• CVE-2025-30028 A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files.High 8.6 · May 27, 2026
• CVE-2025-14713 An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain usHigh 7.5 · May 27, 2026
• CVE-2025-13392 Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69High 8.1 · May 27, 2026
• CVE-2025-12686 Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote aCritical 9.8 · May 27, 2026
• CVE-2023-52945 Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to execute arbitrHigh 7.8 · May 27, 2026
• CVE-2021-47961 A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence the user's PIN code High 8.1 · Apr 10, 2026
• CVE-2025-54160 Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allHigh 7.8 · Dec 4, 2025
• CVE-2025-54159 Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attackers to delete arbitrary files via unspecHigh 7.5 · Dec 4, 2025
• CVE-2025-54158 Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitraHigh 7.8 · Dec 4, 2025
• CVE-2025-29846 A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages.High 7.2 · Dec 4, 2025
• CVE-2024-45539 Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (High 7.5 · Dec 4, 2025
• CVE-2024-45538 Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology UnifCritical 9.6 · Dec 4, 2025
• CVE-2024-53286 Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Router ManagerHigh 7.2 · Jul 23, 2025
• CVE-2025-1021 Missing authorization vulnerability in synocopy in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows remote attackHigh 7.5 · Apr 22, 2025
• CVE-2024-50631 Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in the system syncing daemon in Synology Drive Server before High 7.5 · Mar 19, 2025