High WID-SEC-2026-1125 11 CVEs

Synology DiskStation Manager: Mehrere Schwachstellen

Published Apr 14, 2026 · Updated Sep 20, 2026 · Revision 3 · de-DE

Vendor: Synology Product: DiskStation Manager

Summary

Ein Angreifer kann mehrere Schwachstellen in Synology DiskStation Manager ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

Product

DiskStation Manager (DSM) ist ein webbasiertes Betriebssystem für Synology NAS-Geräte.

Vulnerabilities 11

High 8.0

CVE-2026-40530

An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manag…

Synology DiskStation Manager (DSM)

Sep 18, 2026
High 7.1

CVE-2026-40539

An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-…

Synology DiskStation Manager (DSM)

Sep 18, 2026
Medium 6.5

CVE-2026-4036

An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in…

Synology DiskStation Manager (DSM)

Sep 18, 2026
Medium 6.5

CVE-2026-40532

A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1…

Synology DiskStation Manager (DSM)

Sep 18, 2026
Medium 6.5

CVE-2026-40535

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synol…

Synology DiskStation Manager (DSM)

Sep 18, 2026
Medium 5.4

CVE-2026-40534

An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in S…

Synology DiskStation Manager (DSM)

Sep 18, 2026
Medium 5.3

CVE-2026-40533

An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager …

Synology DiskStation Manager (DSM)

Sep 18, 2026
Medium 4.3

CVE-2026-40531

An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (DSM) before 7.2.1-69…

Synology DiskStation Manager (DSM)

Sep 18, 2026
Medium 4.3

CVE-2026-40536

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synolog…

Synology DiskStation Manager (DSM)

Sep 18, 2026
Medium 4.3

CVE-2026-40537

A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1…

Synology DiskStation Manager (DSM)

Sep 18, 2026
Low 3.7

CVE-2026-40538

An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manage…

Synology DiskStation Manager (DSM)

Sep 18, 2026

Revision history

2026-09-20 #3
Referenz(en) aufgenommen: EUVD-2026-82795, EUVD-2026-82794, EUVD-2026-82796, EUVD-2026-82797
2026-09-17 #2
Referenz(en) aufgenommen: EUVD-2026-82791, EUVD-2026-82789, EUVD-2026-82788, EUVD-2026-82787, EUVD-2026-82786, EUVD-2026-82785, EUVD-2026-82790
2026-04-14 #1
Initiale Fassung

References

Synology Security Advisory vom 2026-04-14
https://www.synology.com/en-global/support/security/Synology_SA_26_06