Synology Contacts CVE-2025-13167

Exploitation requires an authenticated Synology Contacts user account with at least low-level privileges (CVSS PR:L) - unauthenticated exploitation is not possible. A second condition is mandatory victim interaction: a separate user must open or render the malicious contact entry in their browser (CVSS UI:R), meaning the attacker cannot exploit this single-handedly against arbitrary targets. The vulnerability is specific to the contact functionality within the Synology Contacts package; other Synology packages are not indicated as affected. Impact is further bounded by the vendor description to reading or writing specific files containing non-sensitive information - full data exfiltration or system compromise is not a documented outcome. Exploitation is limited to network-accessible Synology Contacts installations running versions before 1.0.10-20659.

Real-world risk for this vulnerability is low. The CVSS score of 5.4 (Medium) reflects meaningful constraints: exploitation requires an authenticated low-privilege user (PR:L) and a separate victim who must interact with the malicious content (UI:R), ruling out fully automated, one-step attacks. EPSS corroborates this assessment - at 0.02% probability of exploitation in the next 30 days (4th percentile), this CVE sits well below any actionable exploitation threshold. SSVC signals align: exploitation status is none, the vulnerability is not automatable, and technical impact is only partial. The described file access impact is explicitly limited to non-sensitive information, further reducing the practical damage ceiling. No conflict between data sources is apparent. This is not a priority emergency patch, but organizations running affected Synology Contacts versions should include the update in routine patch cycles. The Changed scope does warrant attention for environments where Synology Contacts is used with sensitive adjacent browser sessions.

An authenticated low-privilege user - such as a regular Contacts user - crafts a contact entry containing a malicious JavaScript payload in an unsanitized field. When a second user (the victim) opens or views that contact in their browser, the injected script executes in their session with Changed scope, potentially reading or writing specific files accessible to the victim's browser context. No public proof-of-concept code is known at time of analysis.