SB2026041618 - Multiple vulnerabilities in Synology DSM



SB2026041618 - Multiple vulnerabilities in Synology DSM

Published: April 16, 2026

Security Bulletin ID SB2026041618
Severity
Medium
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 64% Low 36%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 secuirty vulnerabilities.


1) CRLF injection (CVE-ID: CVE-2026-40530)

The vulnerability allows a remote user to read or write arbitrary files and cause a denial of service.

The vulnerability exists due to improper neutralization of CRLF sequences in DSM when handling crafted input. A remote user can send specially crafted input to read or write arbitrary files and cause a denial of service.

User interaction is required.


2) SQL injection (CVE-ID: CVE-2026-4036)

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to SQL injection in DSM when processing crafted SQL-related input. A remote user can send a specially crafted request to disclose sensitive information.


3) Integer overflow (CVE-ID: CVE-2026-40531)

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to integer overflow in DSM when processing crafted input. A remote user can send a specially crafted request to cause a denial of service.


4) Forced browsing (CVE-ID: CVE-2026-40532)

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to direct request forced browsing in DSM when handling requests to restricted resources. A remote user can send a specially crafted request to disclose sensitive information.


5) Stored cross-site scripting (CVE-ID: CVE-2026-40534)

The vulnerability allows a remote user to execute arbitrary script in a user's browser.

The vulnerability exists due to cross-site scripting in DSM when rendering crafted web content. A remote user can inject specially crafted content to execute arbitrary script in a user's browser.

User interaction is required.


6) Path traversal (CVE-ID: CVE-2026-40536)

The vulnerability allows a remote user to disclose limited information.

The vulnerability exists due to path traversal in DSM when processing crafted path input. A remote user can send a specially crafted request to disclose limited information.


7) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-40537)

The vulnerability allows a remote user to disclose limited information.

The vulnerability exists due to server-side request forgery in DSM when processing crafted server-side requests. A remote user can send a specially crafted request to disclose limited information.


8) Exposure of Sensitive Information Through Data Queries (CVE-ID: CVE-2026-40533)

The vulnerability allows a remote attacker to obtain non-sensitive information.

The vulnerability exists due to exposure of sensitive information through data queries in DSM when processing data queries. A remote attacker can send a specially crafted request to obtain non-sensitive information.


9) Path traversal (CVE-ID: CVE-2026-40535)

The vulnerability allows a remote attacker to read or write limited files and cause a denial of service.

The vulnerability exists due to path traversal in DSM when processing crafted path input. A remote attacker can send a specially crafted request to read or write limited files and cause a denial of service.


10) Improper Restriction of Excessive Authentication Attempts (CVE-ID: CVE-2026-40538)

The vulnerability allows a remote attacker to obtain non-sensitive information.

The vulnerability exists due to improper restriction of excessive authentication attempts in DSM when handling authentication attempts. A remote attacker can perform repeated authentication attempts to obtain non-sensitive information.


11) Improper Certificate Validation (CVE-ID: CVE-2026-40539)

The vulnerability allows a remote attacker to read or write arbitrary files and cause a denial of service.

The vulnerability exists due to improper certificate validation in DSM when establishing adjacent-network connections. A remote attacker can perform a man-in-the-middle attack to read or write arbitrary files and cause a denial of service.

User interaction is required.


Remediation

Install update from vendor's website.