Skip to main content

Photo Station CVE-2021-29091

MEDIUM
Path Traversal (CWE-22)
2021-06-02 security@synology.com
Synology Path Traversal Photo Station
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

1
CVE Published
Jun 02, 2021 - 02:15 nvd
MEDIUM 6.5

DescriptionNVD

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to write arbitrary files via unspecified vectors.

AnalysisAI

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to write arbitrary files via unspecified vectors. Affected products include: Synology Photo Station. Version information: before 6.8.14.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.

More in Photo Station

View all
CVE-2017-11155 HIGH POC
7.5 Aug 08

An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remot
CVE-2017-11153 CRITICAL POC
9.8 Aug 08

Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allo
CVE-2017-11151 CRITICAL POC
9.8 Aug 08

A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers
CVE-2016-10329 CRITICAL POC
9.8 May 12

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to exec
CVE-2017-11152 HIGH POC
7.5 Aug 08

Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 all
CVE-2019-7195 CRITICAL POC
9.8 Dec 05

This external control of file name or path vulnerability allows remote attackers to access or modify system files. Rated
CVE-2019-7194 CRITICAL POC
9.8 Dec 05

This external control of file name or path vulnerability allows remote attackers to access or modify system files. Rated
CVE-2019-7192 CRITICAL POC
9.8 Dec 05

This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. Rated crit
CVE-2016-10322 HIGH POC
8.8 Apr 10

Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell m
CVE-2022-27593 CRITICAL POC
9.1 Sep 08

An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Statio
CVE-2017-11154 HIGH POC
7.2 Aug 08

Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-296
CVE-2016-10323 HIGH POC
7.8 Apr 10

Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synoph

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2018-13379 CRITICAL POC
9.1
CVE-2015-0016 HIGH POC
7.8

Same technique Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2015-0016 HIGH POC
7.8
CVE-2016-0752 HIGH POC
7.5
CVE-2024-13159 CRITICAL POC
9.8
CVE-2024-13160 CRITICAL POC
9.8
CVE-2024-13161 CRITICAL POC
9.8
CVE-2014-0780 CRITICAL POC
9.8
CVE-2024-48248 HIGH POC
8.6

Share

CVE-2021-29091 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy