SB2026041618 - Multiple vulnerabilities in Synology DSM
Published: April 16, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 secuirty vulnerabilities.
1) CRLF injection (CVE-ID: CVE-2026-40530)
The vulnerability allows a remote user to read or write arbitrary files and cause a denial of service.
The vulnerability exists due to improper neutralization of CRLF sequences in DSM when handling crafted input. A remote user can send specially crafted input to read or write arbitrary files and cause a denial of service.
User interaction is required.
2) SQL injection (CVE-ID: CVE-2026-4036)
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to SQL injection in DSM when processing crafted SQL-related input. A remote user can send a specially crafted request to disclose sensitive information.
3) Integer overflow (CVE-ID: CVE-2026-40531)
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to integer overflow in DSM when processing crafted input. A remote user can send a specially crafted request to cause a denial of service.
4) Forced browsing (CVE-ID: CVE-2026-40532)
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to direct request forced browsing in DSM when handling requests to restricted resources. A remote user can send a specially crafted request to disclose sensitive information.
5) Stored cross-site scripting (CVE-ID: CVE-2026-40534)
The vulnerability allows a remote user to execute arbitrary script in a user's browser.
The vulnerability exists due to cross-site scripting in DSM when rendering crafted web content. A remote user can inject specially crafted content to execute arbitrary script in a user's browser.
User interaction is required.
6) Path traversal (CVE-ID: CVE-2026-40536)
The vulnerability allows a remote user to disclose limited information.
The vulnerability exists due to path traversal in DSM when processing crafted path input. A remote user can send a specially crafted request to disclose limited information.
7) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-40537)
The vulnerability allows a remote user to disclose limited information.
The vulnerability exists due to server-side request forgery in DSM when processing crafted server-side requests. A remote user can send a specially crafted request to disclose limited information.
8) Exposure of Sensitive Information Through Data Queries (CVE-ID: CVE-2026-40533)
The vulnerability allows a remote attacker to obtain non-sensitive information.
The vulnerability exists due to exposure of sensitive information through data queries in DSM when processing data queries. A remote attacker can send a specially crafted request to obtain non-sensitive information.
9) Path traversal (CVE-ID: CVE-2026-40535)
The vulnerability allows a remote attacker to read or write limited files and cause a denial of service.
The vulnerability exists due to path traversal in DSM when processing crafted path input. A remote attacker can send a specially crafted request to read or write limited files and cause a denial of service.
10) Improper Restriction of Excessive Authentication Attempts (CVE-ID: CVE-2026-40538)
The vulnerability allows a remote attacker to obtain non-sensitive information.
The vulnerability exists due to improper restriction of excessive authentication attempts in DSM when handling authentication attempts. A remote attacker can perform repeated authentication attempts to obtain non-sensitive information.
11) Improper Certificate Validation (CVE-ID: CVE-2026-40539)
The vulnerability allows a remote attacker to read or write arbitrary files and cause a denial of service.
The vulnerability exists due to improper certificate validation in DSM when establishing adjacent-network connections. A remote attacker can perform a man-in-the-middle attack to read or write arbitrary files and cause a denial of service.
User interaction is required.
Remediation
Install update from vendor's website.