Synology Chat Server CVE-2026-9548

Exploitation requires two concrete prerequisites: first, the attacker must hold a valid, authenticated Synology Chat Server account (PR:L per CVSS); second, a victim user must actively interact with the attacker-supplied content via the Chat Server UI (UI:R per CVSS). The vulnerable code path is specifically the 'extract domain' feature within Chat Server. Exploitation is not possible by unauthenticated external actors. Deployment configurations that restrict Chat Server access to a small, vetted internal user group significantly reduce the realistic attacker population. The DSM file read/write impact is bounded by the permissions of the victim user's DSM account - victims with limited DSM privileges reduce the downstream impact of a successful exploit.

The vendor-assigned CVSS 6.5 Medium rating is proportionate for this vulnerability. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L signals a network-reachable flaw with low attack complexity, but two factors constrain real-world risk: the attacker must already hold an authenticated Chat Server account (PR:L), and exploitation requires a victim to interact with the crafted content via the UI (UI:R). The scope change to DSM is the most consequential element, as it means the blast radius extends beyond the Chat application to restricted file operations on the underlying NAS. No EPSS data was provided in the source intelligence, and this CVE does not appear in the CISA KEV catalog, suggesting no confirmed widespread active exploitation. No proof-of-concept code is referenced in available data. The realistic threat actor is a malicious insider or a compromised low-privilege Chat account attempting lateral movement within a Synology DSM environment - organizations with broad Chat Server user bases or privileged DSM file shares accessible to Chat should treat patching as a near-term priority rather than an emergency.

An attacker with a low-privilege Synology Chat Server account crafts a message or domain input in the extract domain feature containing a malicious JavaScript payload. When a targeted victim user views or interacts with the crafted content through the Chat UI, the script executes in the victim's browser session under the Chat Server's origin, potentially allowing the attacker to access or modify restricted DSM files or trigger limited DSM denial-of-service conditions - all without requiring any elevated privileges beyond the initial Chat account.