CVE-2026-13683
LowCVSS 2.7Summary
An SQL Injection vulnerability in the EventScheduler API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075 allows remote authenticated users with administrator privileges to obtain non-sensitive information.
Risk Assessment
Administrators could inadvertently expose non-critical data, potentially compromising system integrity.
Recommendation
Update Synology DSM to a version that includes a fix for this vulnerability.
Other vulnerabilities in Synology DiskStation Manager
See all- CVE-2026-6205High
An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks.
- CVE-2026-4036Medium
SQL injection vulnerability in the Sharing API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. A remote authenticated user can exploit this flaw to obtain arbitrary shared files.
- CVE-2026-40539High
An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denial-of-service attacks.
- CVE-2026-40538Low
A vulnerability in the Auto block feature in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks. The issue stems from improper restriction of excessive authentication attempts.
- CVE-2026-40537Medium
Server-Side Request Forgery (SSRF) vulnerability in the PersonMail API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. A remote authenticated user can exploit this flaw to obtain non-sensitive information.
- CVE-2026-40536Medium
Path traversal vulnerability in the Audio API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. A remote authenticated user can exploit this flaw to obtain non-sensitive information.
- CVE-2026-40535Medium
Path traversal vulnerability in the Desktop API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. A remote attacker can write limited files and conduct limited denial-of-service attacks.
- CVE-2026-40534Medium
Cross-site scripting (XSS) vulnerability in the Video API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. A remote authenticated user can read or write limited files when the player is launched.
- CVE-2026-40533Medium
Exposure of sensitive information through data queries vulnerability in the Desktop API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. A remote attacker can obtain non-sensitive information.
- CVE-2026-40532Medium
Forced browsing vulnerability in the Wallpaper Path in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. A remote authenticated user can obtain sensitive information.
Original NVD description (English source)
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to obtain non-sensitive information.