EUVD-2026-67461
GHSA-gjqh-xg93-f8cw
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Authenticated Chat user (PR:L) plus required victim interaction (UI:R) over the network; XSS pivots across a scope boundary (S:C) into DSM enabling file read/write and DoS, so C/I/A:H.
Primary rating from Vendor (synology).
CVSS VectorVendor: synology
Lifecycle Timeline
3DescriptionCVE.org
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM.
Articles & Coverage 1
AnalysisAI
Stored/reflected cross-site scripting in Synology Chat Server before 2.4.5-22148 lets a remote authenticated user who lures a victim into a UI interaction execute injected script that pivots into the underlying DSM platform to read or write arbitrary files and trigger denial-of-service. The vendor-assigned CVSS 9.0 reflects a scope change (S:C) where compromise of the chat add-on cascades into the host DiskStation Manager operating system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) a valid authenticated Synology Chat account on the target server (CVSS PR:L - low privilege but not anonymous), and (2) a victim UI interaction in the Chat web interface (CVSS UI:R), meaning a logged-in user must view/click the malicious content for the script to fire. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H = 9.0) indicates network reachability, low complexity, low-privilege authentication, and required user interaction, with full confidentiality/integrity/availability impact amplified by a scope change into DSM. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Synology Chat Server to 2.4.5-22148 or later via DSM Package Center, per Synology advisory Synology_SA_26_10 (https://www.synology.com/en-global/security/advisory/Synology_SA_26_10). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: conduct complete inventory of all Synology Chat Server deployments and document exact version numbers across the infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Synology Chat Server
View allCross-site scripting in Synology Chat Server's extract domain feature allows authenticated remote users to inject malici
Server-Side Request Forgery in Synology Chat Server's webhook functionality allows remote authenticated users to probe i
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today