Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2026-13684 EUVD-2026-82772GHSA-f4qf-hcj6-jwp9

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9…

Published Sep 18, 2026 · Updated Sep 18, 2026 · Assigned by synology

Vendor: Synology Product: DiskStation Manager (DSM)

Description

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.

Affected products

VendorProductAffectedFixed
Synology DiskStation Manager (DSM) 7.4 – < 7.4-90075, 7.3.2 – < 7.3.2-86009-4, 7.2.2 – < 7.2.2-72806-9, 7.2.1 – < 7.2.1-69057-12 7.4-90075

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

  • SHIFox8/synology-dsm-vuln-scanner ★ 3 · Oct 30, 2026

    Detection-only vulnerability scanner for Synology DSM — CVE-2024-10441 (SA-24:20, ransomware-exploited) and CVE-2026-13684/13639 (SA-26:13). Read-only fingerprinting, no exploits. Python 3.9+, zero d…

  • maxprog-svg/CVE-2026-13684 ★ 0 · Nov 8, 2026

    CVE-2026-13684 — Synology DSM Arbitrary File Read/Write + DoS

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References