CVE-2026-26244: SQLi#1 SQL Injection in class_videos.php _getFilters
Published Oct 15, 2026
·Updated
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
Affected Software
1 affected component
Synology Video Station<5.8.8
Event History
Oct 15, 2026
CVE Published
via MITRE·09:29 AM
Data Sourced
via MITRE·09:29 AM
RemedyDescriptionWeakness
Frequently Asked Questions
1
Who is exposed to exploitation?
Video Station deployments are exposed if an attacker can obtain a user account. The reported attack is remote, but it requires authenticated access.
2
Which versions contain the fix?
The vulnerability is fixed in Video Station 5.8.8 and later. Systems running an earlier version should be treated as potentially affected based on the available information.
3
What is the impact after successful exploitation?
An authenticated remote attacker may exploit the SQL injection to execute unauthorized code or commands.