EUVD-2026-82772
GHSA-f4qf-hcj6-jwp9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated (AV:N/PR:N) low-complexity request to SCGI yields arbitrary file read (C:H), arbitrary file write (I:H) and DoS (A:H); no scope change beyond the DSM host.
Primary rating from Vendor (synology).
CVSS VectorVendor: synology
Lifecycle Timeline
3DescriptionCVE.org
An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
Articles & Coverage 2
AnalysisAI
Improper output encoding in the SCGI service of Synology DiskStation Manager (DSM) lets unauthenticated remote attackers read or write arbitrary files on the appliance and mount denial-of-service attacks against it. Every DSM build prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, or 7.4-90075 is affected, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8) confirms no credentials, user interaction, or non-default settings are needed - the only real precondition is network reachability to the SCGI interface, which makes internet-facing NAS units the highest-risk deployments while firewall/VPN-isolated devices carry substantially lower risk. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network reachability to the SCGI interface of a Synology DSM instance running a version prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, or 7.4-90075. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority vulnerability, not a paper tiger. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the fixed build for your DSM branch: 7.2.1-69057-12 or later, 7.2.2-72806-9 or later, 7.3.2-86009-4 or later, or 7.4-90075 or later - Synology DSM's Control Panel > Update & Restore performs this in place, and the details are in Synology advisory Synology_SA_26_13. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Synology DSM appliance in the estate using the advisory's affected build thresholds, flagging any device running a build prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, or 7.4-90075, and identify which of those have SCGI reachable from the internet or guest networks; block inbound access to those interfaces at the perimeter and host firewall, disable port forwarding and external QuickConnect exposure for vulnerable units, and enable verbose logging on the affected appliances so any anomalous file access is captured. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Diskstation Manager Dsm
View allSynology DiskStation Manager (DSM) login logic uses insufficiently random values, letting remote unauthenticated attacke
Authenticated remote attackers holding low-privileged credentials can exploit an incorrect permission assignment in the
An external control of file name or path flaw in the Synology DiskStation Manager (DSM) Upload API allows remote authent
CRLF injection in the Synology DiskStation Manager (DSM) User API lets a remote, low-privileged authenticated user (PR:L
Man-in-the-middle attackers positioned on the network path between a Synology DiskStation and its configured mail server
Unauthenticated path traversal in the Synology DiskStation Manager (DSM) Desktop API allows remote attackers to write a
Information disclosure in Synology DiskStation Manager (DSM) allows remote authenticated users to obtain sensitive infor
An authenticated SQL injection in the Sharing API of Synology DiskStation Manager (DSM) allows remote users with valid -
Cross-site scripting in the Video API of Synology DiskStation Manager (DSM) allows a remote authenticated user to read o
Unauthenticated remote attackers can query the Desktop API in Synology DiskStation Manager (DSM) to retrieve non-sensiti
Improper encoding and escaping of output in the Auth API of Synology DiskStation Manager (DSM) lets remote, unauthentica
Cross-site scripting in the Synology DiskStation Manager (DSM) Theme API lets a remote attacker who already holds DSM ad
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today