CVE-2026-16550 · Infrastructure
NO FIX YET · SEE WHAT TO DO
A path-handling flaw in the Media Parser of Synology DiskStation Manager lets a remote user who is already logged in write files to arbitrary locations. The sources do not describe code execution, so the reach beyond file writes is unknown.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Systems running Synology DiskStation Manager before 7.3.2-86009-5 or 7.4.1-90080-1 are in scope. Exposure requires an authenticated remote account, so instances without user accounts open to outsiders are less exposed. The sources do not say whether the Media Parser is enabled by default.
Not affected if auth-required, patched-dsm
Who cares dsm, nas, self-hosted, synology
7.3.2-86009-5 and 7.4.1-90080-1 is affected; move to a fixed release on the matching branchAn external control of file name or path vulnerability in the Media Parser in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write arbitrary files.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.