CVE-2025-66272: Arbitrary file deletion and remote code execution
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Synology Video Station deployments running a version earlier than 5.8.5 are affected if an attacker can obtain a user account. The reported attack is remote, but it requires authenticated access.
What access does an attacker need to exploit the vulnerability?
The attacker must first gain a Video Station user account. The available information does not describe any unauthenticated exploitation path.
What should be done to remediate the issue?
Upgrade Synology Video Station to version 5.8.5 or later. This is the version range identified as containing the fix.
How can I determine whether my installation is affected?
Check the installed Synology Video Station version. Versions before 5.8.5 should be treated as affected based on the supplied advisory information.