CVE-2026-18792: Path Traversal

Published Nov 12, 2026

Updated

An improper limitation of a pathname to a restricted directory vulnerability in the Sharing API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Synology DiskStation Manager (DSM) Sharing API; DSM 7.4 fix: 7.4.1-90080-1 to a version that resolves this vulnerability.
Fixed in 7.3.2-86009-5

Event History

Nov 12, 2026

CVE Published

via MITRE·03:32 AM

Data Sourced

via MITRE·03:32 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

A remote attacker must be authenticated to DSM. The provided information does not indicate that unauthenticated users can exploit it.

What impact can successful exploitation have?

An authenticated remote user may read or write arbitrary files and cause denial of service. The CVSS vector indicates high impacts to confidentiality, integrity, and availability.

Which DSM versions need updating?

DSM versions before 7.3.2-86009-5 and before 7.4.1-90080-1 are affected. Update to the applicable listed version or later.

CVE-2026-18792: Path Traversal

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What impact can successful exploitation have?

Which DSM versions need updating?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What impact can successful exploitation have?

Which DSM versions need updating?