by Kastro
Paper/Archive/CVE-2026-13684

CVE-2026-13684

Synology DiskStation Manager (DSM) — An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806…

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 48.7.487 × 209.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.

Affected

ProductAffectedFixed inSource
DiskStation Manager (DSM)7.4 – < 7.4-900757.4-90075CNA
DiskStation Manager (DSM)7.3.2 – < 7.3.2-86009-47.3.2-86009-4CNA
DiskStation Manager (DSM)7.2.2 – < 7.2.2-72806-97.2.2-72806-9CNA
DiskStation Manager (DSM)7.2.1 – < 7.2.1-69057-127.2.1-69057-12CNA

Scores by source

synology (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsynology.com/en-global/security/advisory/Synology_SA_26_13