CVE-2026-13656: XSS

Published Nov 12, 2026

Updated

An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files.

Event History

Nov 12, 2026

CVE Published

via MITRE·03:36 AM

Data Sourced

via MITRE·03:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

A remote attacker must be authenticated to DSM. The user must also interact with a crafted web page or content, as indicated by the user-interaction requirement.

What impact can successful exploitation have?

Successful exploitation can allow an authenticated remote user to read or write specific files. The vulnerability is scoped to the Audio Player component in DSM.

Which DSM versions are affected?

DSM versions before 7.3.2-86009-5 and before 7.4.1-90080-1 are affected.

CVE-2026-13656: XSS

Event History

Frequently Asked Questions

Which users can exploit this issue?

What impact can successful exploitation have?

Which DSM versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What impact can successful exploitation have?

Which DSM versions are affected?