Path Traversal Vulnerability in Synology BeeDrive for Desktop
CVE-2025-54160

7.8HIGH

Key Information:

Vendor

Synology
Status
Beedrive For Desktop
Vendor
CVE Published:
4 December 2025

What is CVE-2025-54160?

A path traversal vulnerability has been identified in Synology BeeDrive for desktop, allowing local users to exploit improper limitations on pathname restrictions. This flaw enables the execution of arbitrary code through unspecified vectors, posing serious security risks for affected systems. Users are urged to update to version 1.4.2-13960 or later to mitigate this issue and secure their environment against potential threats highlighted in the advisory.

Affected Version(s)

BeeDrive for desktop *

References

https://www.synology.com/en-global/security/advisory/Syno...
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zhao Runzi (赵润梓)
JSON
.
CVE-2025-54160 : Path Traversal Vulnerability in Synology BeeDrive for Desktop