CVE-2026-26245: SQLi#2 SQL Injection in class_videos.php getSmartVideosByOffset
Published Oct 15, 2026
·Updated
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
Affected Software
1 affected component
Synology Video Station<5.8.8
Event History
Oct 15, 2026
CVE Published
via MITRE·09:29 AM
Data Sourced
via MITRE·09:29 AM
RemedyDescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A remote attacker must first gain a user account. The available information does not indicate that unauthenticated attackers can exploit it.
2
Which versions are affected?
Video Station versions earlier than 5.8.8 are affected according to the provided remediation information. Video Station 5.8.8 and later contain the fix.
3
What could successful exploitation allow?
An authenticated remote attacker could exploit the SQL injection to execute unauthorized code or commands.