CVE-2026-88266: Medium severity vulnerability
An external control of system or configuration setting vulnerability in the synomount in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Synology DiskStation Manager (DSM)to a version that resolves this vulnerability.Fixed in 7.3.2-86009-5 - Upgrade
Upgrade
Synology DiskStation Manager (DSM)to a version that resolves this vulnerability.Fixed in 7.4.1-90080-1
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
A remote attacker must be authenticated to DSM. The provided data does not indicate that unauthenticated users can exploit it.
What is the impact of successful exploitation?
An authenticated remote user can write specific files. The stated impact is limited to integrity; no confidentiality or availability impact is identified.
Which DSM releases are affected?
DSM versions before 7.3.2-86009-5 and before 7.4.1-90080-1 are affected. Systems at or above the applicable listed release are not described as vulnerable.