{"id":"CVE-2026-13656","kind":"vulnerability","aliases":["CVE-2026-13656"],"related":[],"title":"Synology DSM: Audio Player flaw lets logged-in users read or write files","description":"An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files.","summary":"The Audio Player in Synology DiskStation Manager has an input-neutralization flaw in generated web pages. A remote user who already has a login can read or write certain files on the NAS.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dsm","infrastructure","nas","self-hosted","synology"],"not_affected_if":["audio-player-not-installed","dsm-patched","no-remote-accounts"],"how_to_check":"- Check the DSM version in Control Panel > Info Center; the affected builds are those before `7.3.2-86009-5` and `7.4.1-90080-1`.\n- Confirm whether the Audio Player package is installed on the NAS.","fix":"- Move DSM to `7.3.2-86009-5` or later on the 7.3 branch, or `7.4.1-90080-1` or later on the 7.4 branch.","status":"open","published_at":"2026-11-12T04:17:18+00:00","first_seen_at":"2026-11-12T04:47:08+00:00","triaged_at":"2026-11-12T04:47:57+00:00","updated_at":"2026-11-12T04:47:57+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-12T04:47:57Z","model":"claude-haiku-5-5","output":{"fix":"- Move DSM to `7.3.2-86009-5` or later on the 7.3 branch, or `7.4.1-90080-1` or later on the 7.4 branch.","reach":"network","title":"Synology DSM: Audio Player flaw lets logged-in users read or write files","impact":"medium","summary":"The Audio Player in Synology DiskStation Manager has an input-neutralization flaw in generated web pages. A remote user who already has a login can read or write certain files on the NAS.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["synology","dsm","nas","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated users read or write specific files on the NAS","analyst_note":"","how_to_check":"- Check the DSM version in Control Panel > Info Center; the affected builds are those before `7.3.2-86009-5` and `7.4.1-90080-1`.\n- Confirm whether the Audio Player package is installed on the NAS.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["dsm-patched","audio-player-not-installed","no-remote-accounts"],"who_is_affected":"Synology DiskStation Manager systems running the Audio Player with versions before the listed fixed builds. Exposure requires an authenticated remote user, so systems where only trusted staff have accounts carry less risk. Systems with no Audio Player use are less exposed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000728,"input_tokens":4533,"output_tokens":550,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1':88C '-13656':17A,20A '-2026':16A,19A '-5':84C '-86009':83C '-90080':87C '7.3.2':82C '7.4.1':86C 'allow':89C 'alreadi':49B 'audio':3A,29B,74C 'authent':91C 'certain':57B 'cve':15A,18A 'diskstat':33B,78C 'dsm':2A,21B,80C 'file':14A,58B,98C 'flaw':5A,40B 'generat':42B,70C 'host':26B 'improp':63C 'infrastructur':22B 'input':38B,66C 'input-neutr':37B 'let':6A 'log':8A 'logged-in':7A 'login':52B 'manag':34B,79C 'nas':23B,61B 'neutral':39B,64C 'page':44B,69C 'player':4A,30B,75C 'read':11A,54B,94C 'remot':46B,90C 'self':25B 'self-host':24B 'specif':97C 'synolog':1A,27B,32B,77C 'user':10A,47B,92C 'vulner':71C 'web':43B,68C 'write':13A,56B,96C","nicknames":[],"mitigations":[],"who_affected":"Synology DiskStation Manager systems running the Audio Player with versions before the listed fixed builds. Exposure requires an authenticated remote user, so systems where only trusted staff have accounts carry less risk. Systems with no Audio Player use are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dsm","infrastructure","medium","nas","selfhosted","synology"],"campaign_type":null,"search_a":"'-13656':17A,20A '-2026':16A,19A 'audio':3A 'cve':15A,18A 'dsm':2A 'file':14A 'flaw':5A 'let':6A 'log':8A 'logged-in':7A 'player':4A 'read':11A 'synolog':1A 'user':10A 'write':13A","search_b":"'alreadi':49B 'audio':29B 'certain':57B 'diskstat':33B 'dsm':21B 'file':58B 'flaw':40B 'generat':42B 'host':26B 'infrastructur':22B 'input':38B 'input-neutr':37B 'login':52B 'manag':34B 'nas':23B,61B 'neutral':39B 'page':44B 'player':30B 'read':54B 'remot':46B 'self':25B 'self-host':24B 'synolog':27B,32B 'user':47B 'web':43B 'write':56B","search_c":"'-1':88C '-5':84C '-86009':83C '-90080':87C '7.3.2':82C '7.4.1':86C 'allow':89C 'audio':74C 'authent':91C 'diskstat':78C 'dsm':80C 'file':98C 'generat':70C 'improp':63C 'input':66C 'manag':79C 'neutral':64C 'page':69C 'player':75C 'read':94C 'remot':90C 'specif':97C 'synolog':77C 'user':92C 'vulner':71C 'web':68C 'write':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security@synology.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-13656","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13656","severity":null,"published_at":"2026-11-12T04:17:18+00:00","modified_at":"2026-11-12T04:17:18+00:00","first_seen_at":"2026-11-12T04:47:08+00:00","fetched_at":"2026-11-12T04:47:08+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}