CVE-2026-13623
MediumCVSS 4.8Summary
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in the Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write limited files.
Risk Assessment
An administrator-level attacker can leverage XSS to read or modify limited files, potentially breaching data confidentiality and integrity. Exploitation requires an account with administrator privileges.
Recommendation
Update Synology DSM to version 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, 7.4-90075 or later. Apply least privilege — limit the number of administrator accounts.
Other vulnerabilities in Synology DiskStation Manager (DSM)
See all- CVE-2026-13635Medium
An improper encoding or escaping of output vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information.
- CVE-2017-15889High
A command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before version 5.2-5967-5 allows remote authenticated users to execute arbitrary commands via the disk field.
- CVE-2026-13684Critical
An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
- CVE-2026-13639Critical
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
Original NVD description (English source)
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write limited files.