What is the CVSS score of CVE-2025-13167?

CVE-2025-13167 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2025-13167?

Yes, a patch is available for CVE-2025-13167. Update the affected software to the latest version immediately.

Synology Contacts CVE-2025-13167

EUVD-2025-209954 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@synology.com

GHSA-32xh-xfmp-f6p6

XSS Synology

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:21 vuln.today

Patch available

May 27, 2026 - 19:46 EUVD

DescriptionCVE.org

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functionality in Synology Contacts before 1.0.10-20659 allows remote authenticated users to read or write specific files containing non-sensitive information via unspecified vectors.

AnalysisAI

Cross-site scripting in Synology Contacts before version 1.0.10-20659 allows authenticated remote users to read or write specific files containing non-sensitive information by injecting malicious input through the contact functionality. The CVSS scope change (S:C) confirms the injected script executes in a context beyond the originating application, affecting any victim who views the crafted contact entry. No public exploit identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog.

Technical ContextAI

This is a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability - a classic XSS defect where user-supplied data is rendered in a web page without adequate sanitization or encoding. The affected component is the contact functionality within Synology Contacts, a web-based contact management application distributed as a Synology DiskStation Package. The CVSS scope flag S:C (Changed) is significant: it indicates the vulnerability crosses trust boundaries, meaning injected script can interact with browser resources outside the Synology Contacts application itself. The attack vector is network-based (AV:N) and requires only low-level authenticated access (PR:L), consistent with a regular end-user account rather than an administrator. The full affected version range is Synology Contacts any version up to and not including 1.0.10-20659, as confirmed by both NVD CPE data and the ENISA EUVD entry EUVD-2025-209954.

RemediationAI

Update Synology Contacts to version 1.0.10-20659 or later. The patch is confirmed available from the vendor per Synology Security Advisory SA_25_13 at https://www.synology.com/en-global/security/advisory/Synology_SA_25_13. Updates can be applied through the DiskStation Manager Package Center. If immediate patching is not feasible, a compensating control is to restrict Contacts write access to trusted, verified users only, reducing the pool of potential attackers who could inject malicious content. Additionally, limiting sharing or external visibility of contact entries reduces the likelihood of a victim rendering injected content. No significant side effects of upgrading to 1.0.10-20659 are documented by the vendor.