Web Page Generation Vulnerability in Synology DiskStation Manager
CVE-2026-92379

5.4MEDIUM

Key Information:

Vendor

Synology
Status
Diskstation Manager (dsm)
Vendor
CVE Published:
12 November 2026

What is CVE-2026-92379?

A vulnerability has been identified in Synology DiskStation Manager that allows remote authenticated users to read or write specific files due to improper handling of input during web page generation in the Notification API. This can lead to unauthorized access and potential information exposure. Users are urged to review their system updates and security settings to mitigate risks.

Affected Version(s)

DiskStation Manager (DSM) 7.4.1

DiskStation Manager (DSM) 7.4.1 < 7.4.1-90080-1

DiskStation Manager (DSM) 7.3.2 < 7.3.2-86009-5

References

https://www.synology.com/en-global/security/advisory/Syno...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joe Lovett
.