Improper Encoding Vulnerability in Synology DiskStation Manager
CVE-2026-13684

9.8CRITICAL

Key Information:

Vendor

Synology
Status
Diskstation Manager (dsm)
Vendor
CVE Published:
18 September 2026

What is CVE-2026-13684?

An improper encoding or escaping of output vulnerability in Synology DiskStation Manager affects multiple versions, enabling remote attackers to potentially read or write arbitrary files. This may lead to unauthorized access and could facilitate denial-of-service attacks, compromising the system's stability and data integrity. The issue emphasizes the necessity of urgent patching to maintain security and protect user data.

Affected Version(s)

DiskStation Manager (DSM) 7.4

DiskStation Manager (DSM) 7.4 < 7.4-90075

DiskStation Manager (DSM) 7.3.2 < 7.3.2-86009-4

References

https://www.synology.com/en-global/security/advisory/Syno...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lam Jun Rong (https://jro.sg)
.