CVE-2026-40530
HighCVSS 8.0Summary
An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks after the system is rebooted.
Risk Assessment
An authenticated attacker can manipulate data and cause service unavailability, potentially leading to loss of integrity and business continuity.
Recommendation
Update Synology DSM to version 7.2.1-69057-10, 7.2.2-72806-7, 7.3.2-86009-2 or later, and restrict privileges of accounts with access to the User API.
Other vulnerabilities in Synology DiskStation Manager
See all- CVE-2026-6205High
An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks.
- CVE-2026-4036Medium
SQL injection vulnerability in the Sharing API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. A remote authenticated user can exploit this flaw to obtain arbitrary shared files.
- CVE-2026-40539High
An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denial-of-service attacks.
- CVE-2026-40538Low
A vulnerability in the Auto block feature in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks. The issue stems from improper restriction of excessive authentication attempts.
- CVE-2026-40537Medium
Server-Side Request Forgery (SSRF) vulnerability in the PersonMail API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. A remote authenticated user can exploit this flaw to obtain non-sensitive information.
- CVE-2026-40536Medium
Path traversal vulnerability in the Audio API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. A remote authenticated user can exploit this flaw to obtain non-sensitive information.
- CVE-2026-40535Medium
Path traversal vulnerability in the Desktop API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. A remote attacker can write limited files and conduct limited denial-of-service attacks.
- CVE-2026-40534Medium
Cross-site scripting (XSS) vulnerability in the Video API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. A remote authenticated user can read or write limited files when the player is launched.
- CVE-2026-40533Medium
Exposure of sensitive information through data queries vulnerability in the Desktop API in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. A remote attacker can obtain non-sensitive information.
- CVE-2026-40532Medium
Forced browsing vulnerability in the Wallpaper Path in Synology DiskStation Manager (DSM) before versions 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. A remote authenticated user can obtain sensitive information.
Original NVD description (English source)
An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks after the system is rebooted.