Cross-site Scripting Vulnerability in Synology DiskStation Manager
CVE-2026-13623

4.8MEDIUM

Key Information:

Vendor

Synology
Status
Diskstation Manager (dsm)
Vendor
CVE Published:
18 September 2026

What is CVE-2026-13623?

An issue in Theme API of Synology DiskStation Manager allows remote authenticated users with administrator privileges to exploit an improper neutralization of input during web page generation. This vulnerability can lead to unauthorized read or write access to limited files within the system, posing a serious risk to data integrity and confidentiality.

Affected Version(s)

DiskStation Manager (DSM) 7.4

DiskStation Manager (DSM) 7.4 < 7.4-90075

DiskStation Manager (DSM) 7.3.2 < 7.3.2-86009-4

References

https://www.synology.com/en-global/security/advisory/Syno...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Juhyeop Lee (STEALIEN INC.) https://www.stealien.com
.