CVE-2026-74850: Path Traversal

Published Nov 12, 2026

Updated

An improper limitation of a pathname to a restricted directory vulnerability in the contentextract in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read specific files.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Synology DiskStation Manager (DSM) contentextract to a version that resolves this vulnerability.
Fixed in 7.3.2-86009-5
Upgrade
Upgrade Synology DiskStation Manager (DSM) contentextract to a version that resolves this vulnerability.
Fixed in 7.4.1-90080-1

Event History

Nov 12, 2026

CVE Published

via MITRE·03:38 AM

Data Sourced

via MITRE·03:38 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which DSM releases are affected?

DSM releases before 7.3.2-86009-5 and before 7.4.1-90080-1 are affected.

What access does an attacker need?

An attacker must be able to authenticate remotely. No user interaction is required.

What is the impact of exploitation?

A successful attacker can read specific files. The provided severity vector indicates low confidentiality impact and no integrity or availability impact.

CVE-2026-74850: Path Traversal

Remediation

Event History

Frequently Asked Questions

Which DSM releases are affected?

What access does an attacker need?

What is the impact of exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which DSM releases are affected?

What access does an attacker need?

What is the impact of exploitation?