High priorityDisclosed

Advisory · CVE-2026-18792

Path traversal in Synology DSM Sharing API lets authenticated users read and write arbitrary files

Synology DiskStation Manager before 7.3.2-86009-5 and 7.4.1-90080-1 lets a remote authenticated user escape the intended directory through the Sharing API and read or write arbitrary files.

Advisory published November 12, 2026Independent summary
Vendor
Synology
Product
DiskStation Manager (DSM)
Identifier / CWE
CVE-2026-18792
CWE-22
Action timing
Immediate
ELI5

Explain it like I’m five

The file-sharing feature is supposed to keep each user inside their own folders. This flaw lets a signed-in user slip a dot-dot-slash style path into a sharing request and walk out of their folder into any file on the system.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Authenticated session

    An attacker logs in to DSM with any valid low-privilege account.

  2. 02Crafted sharing request

    The attacker sends a Sharing API request containing a pathname that escapes the intended directory.

  3. 03Restriction not enforced

    DSM does not limit the pathname to the restricted directory.

  4. 04Files exposed

    The attacker reads or writes arbitrary files and can cause denial of service.

What happened

Synology reports an improper limitation of a pathname to a restricted directory in the Sharing API of DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1. A remote authenticated user can exploit it to read or write arbitrary files and conduct denial-of-service attacks. Synology rates it important at CVSS 8.8.

What to do

  1. Upgrade DSM to 7.3.2-86009-5 or 7.4.1-90080-1, matching the installed branch, or a later release.
  2. Until patched, limit DSM access to trusted users and review who can use file sharing.
  3. Review Sharing API and file access logs for paths containing traversal sequences or access outside shared folders.
  4. Check for unexpected file modifications, especially in system and configuration directories.
  5. Confirm the patched DSM version is running after the upgrade.

Management note

File sharing is the feature most users touch daily, and this flaw turns any account into one that can reach system files. It is a strong reason to patch promptly rather than wait for the next maintenance window.