CRLF Injection Vulnerability in Synology DiskStation Manager
CVE-2026-13666

3.5LOW

Key Information:

Vendor

Synology
Status
Diskstation Manager (dsm)
Vendor
CVE Published:
18 September 2026

What is CVE-2026-13666?

A vulnerability has been identified within the Sharing API of Synology DiskStation Manager. This issue allows remote authenticated users to exploit CRLF injection, facilitating unauthorized file writing capabilities. When a victim interacts with a manipulated sharing URL, an attacker may leverage this flaw to execute harmful actions, potentially compromising system integrity. Users are advised to update to the latest versions of DSM to mitigate this risk.

Affected Version(s)

DiskStation Manager (DSM) 7.4

DiskStation Manager (DSM) 7.4 < 7.4-90075

DiskStation Manager (DSM) 7.3.2 < 7.3.2-86009-4

References

https://www.synology.com/en-global/security/advisory/Syno...

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Brendan O'Rourke
.