CVE-2026-16550: Medium severity vulnerability

Published Nov 12, 2026

Updated

An external control of file name or path vulnerability in the Media Parser in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write arbitrary files.

Event History

Nov 12, 2026

CVE Published

via MITRE·03:35 AM

Data Sourced

via MITRE·03:35 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

An attacker must be able to authenticate remotely to DSM. No user interaction is required, and the attack complexity is low.

Which DSM versions are affected?

DSM versions before 7.3.2-86009-5 and before 7.4.1-90080-1 are affected.

What is the impact of successful exploitation?

A successful attacker can write arbitrary files through the Media Parser. The stated impact is integrity loss; confidentiality and availability impacts are not listed.

CVE-2026-16550: Medium severity vulnerability

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which DSM versions are affected?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which DSM versions are affected?

What is the impact of successful exploitation?