CVE-2026-4036: SQL Injection
An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker must be authenticated to DSM. The provided information does not identify which authenticated roles or permissions are sufficient.
What data could an attacker access?
An authenticated remote attacker could obtain arbitrary sharing files through the Sharing API. The issue affects confidentiality; no integrity or availability impact is stated.
Which DSM versions need updating?
DSM versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2 are affected. Systems on the corresponding listed version or a later version are not identified as affected by this advisory.