3.5
CVE-2026-13666
- EPSS 0.19%
- Veröffentlicht 18.09.2026 08:22:29
- Zuletzt bearbeitet 18.09.2026 20:17:07
- Erkennungen
An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write limited files when a victim clicks a sharing URL.Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerSynology
≫
Produkt
DiskStation Manager (DSM)
Default Statusaffected
Version
7.4
Version <
7.4-90075
Status
affected
Version
7.3.2
Version <
7.3.2-86009-4
Status
affected
Version
7.2.2
Version <
7.2.2-72806-9
Status
affected
Version
7.2.1
Version <
7.2.1-69057-12
Status
affected
Version
0
Version <
7.2.1
Status
unknown
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.19% | 0.093 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| Synology | 3.5 | 2.1 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
|
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
https://www.synology.com/en-global/security/advisory/Synology_SA_26_13