What is the CVSS score of EUVD-2026-82779?

EUVD-2026-82779 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-82779?

Yes, a patch is available for EUVD-2026-82779. Update the affected software to the latest version immediately.

Synology DSM EUVD-2026-82779

| CVE-2026-13666 LOW

Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

2026-09-18 synology

GHSA-7969-99rg-6xxh

Code Injection Synology Diskstation Manager Dsm

3.5

CVSS 3.1 · Vendor: synology

Severity by source

Vendor (synology) PRIMARY

3.5 LOW

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

3.5 LOW

Authenticated user (PR:L) triggers CRLF injection over the network but needs a victim to click the sharing URL (UI:R); impact is limited file write only, so I:L with C:N/A:N.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (synology).

CVSS VectorVendor: synology

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Sep 18, 2026 - 09:16 EUVD

Analysis Generated

Sep 18, 2026 - 09:14 vuln.today

DescriptionCVE.org

An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write limited files when a victim clicks a sharing URL.

AnalysisAI

Improper neutralization of CRLF sequences in the Sharing API of Synology DiskStation Manager (DSM) allows remote authenticated users to write limited files on the appliance when a victim clicks an attacker-crafted sharing URL. The issue affects DSM builds prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075, and is scored CVSS 3.1 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) - a low-priority rating the vector fairly reflects, since exploitation requires both a valid low-privileged DSM account and a victim's click-through, and yields only a low integrity impact with no confidentiality or availability loss. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires: (1) valid authenticated DSM account with at least low privileges to reach the Sharing API (PR:L); (2) a victim who must actively click an attacker-crafted sharing URL (UI:R). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a low-priority issue that the CVSS score (3.5) fairly reflects. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patches are available: upgrade DSM to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, or 7.4-90075 (or any later build on the corresponding branch), and consult Synology advisory SA_26_13 at https://www.synology.com/en-global/security/advisory/Synology_SA_26_13 for the official version matrix. … Detailed patch versions, workarounds, and compensating controls in full report.