CVE-2026-40532: Medium severity Synology DiskStation Manager (DSM) vulnerability
Published Sep 18, 2026
·Updated
A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information.
Affected Software
1 affected component
Synology DiskStation Manager (DSM)<7.2.1-69057-10, <7.2.2-72806-7, <7.3.2-86009-2
Event History
Sep 18, 2026
CVE Published
via MITRE·08:27 AM
Data Sourced
via MITRE·08:27 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A remote attacker must be authenticated to DSM and have at least low-level privileges. No user interaction is required.
2
What is the impact of successful exploitation?
An authenticated attacker can obtain sensitive information through direct requests to the Wallpaper Path functionality. The provided data does not indicate any integrity or availability impact.
3
Which DSM versions need to be remediated?
DSM versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2 are affected. Upgrade to the applicable listed fixed version or later.