CVE-2026-34014: ds-move-files.sh is writable and executed as root
Published Oct 15, 2026
·Updated
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later
Affected Software
1 affected component
Synology Download Station<5.10.1.312, <5.11.2.321
Event History
Oct 15, 2026
CVE Published
via MITRE·09:30 AM
Data Sourced
via MITRE·09:30 AM
RemedyDescriptionWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker must first obtain a local administrator account. The reported issue can then be used to compromise system security.
2
Which releases contain the fix?
The vulnerability is fixed in Download Station 5.10.1.312 and later, and in Download Station 5.11.2.321 and later.