{"id":"CVE-2026-16550","kind":"vulnerability","aliases":["CVE-2026-16550"],"related":[],"title":"Synology DSM: Media Parser flaw lets logged-in users write arbitrary files","description":"An external control of file name or path vulnerability in the Media Parser in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write arbitrary files.","summary":"A path-handling flaw in the Media Parser of Synology DiskStation Manager lets a remote user who is already logged in write files to arbitrary locations. The sources do not describe code execution, so the reach beyond file writes is unknown.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dsm","infrastructure","nas","self-hosted","synology"],"not_affected_if":["auth-required","patched-dsm"],"how_to_check":"- Check the installed DSM version in DSM under Control Panel > Info Center (version string not confirmed by sources)","fix":"- Synology DSM before `7.3.2-86009-5` and `7.4.1-90080-1` is affected; move to a fixed release on the matching branch","status":"open","published_at":"2026-11-12T04:17:18+00:00","first_seen_at":"2026-11-12T04:47:08+00:00","triaged_at":"2026-11-12T04:47:49+00:00","updated_at":"2026-11-12T04:47:49+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-12T04:47:49Z","model":"claude-haiku-5-5","output":{"fix":"- Synology DSM before `7.3.2-86009-5` and `7.4.1-90080-1` is affected; move to a fixed release on the matching branch\n- unknown for exact fixed build per branch beyond these","reach":"network","title":"Synology DSM: Media Parser flaw lets logged-in users write arbitrary files","impact":"medium","summary":"A path-handling flaw in the Media Parser of Synology DiskStation Manager lets a remote user who is already logged in write files to arbitrary locations. The sources do not describe code execution, so the reach beyond file writes is unknown.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["synology","dsm","nas","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated remote user writes arbitrary files on the NAS","analyst_note":"Confirm default enablement of the Media Parser and the exact fixed build per DSM branch from Synology's advisory.","how_to_check":"- Check the installed DSM version in DSM under Control Panel > Info Center (version string not confirmed by sources)\n- unknown for further checks; the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required","patched-dsm"],"who_is_affected":"Systems running Synology DiskStation Manager before 7.3.2-86009-5 or 7.4.1-90080-1 are in scope. Exposure requires an authenticated remote account, so instances without user accounts open to outsiders are less exposed. The sources do not say whether the Media Parser is enabled by default.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000755,"input_tokens":4535,"output_tokens":603,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1':94C '-16550':16A,19A '-2026':15A,18A '-5':90C '-86009':89C '-90080':93C '7.3.2':88C '7.4.1':92C 'allow':95C 'alreadi':46B 'arbitrari':12A,52B,101C 'authent':97C 'beyond':64B 'code':59B 'control':71C 'cve':14A,17A 'describ':58B 'diskstat':38B,84C 'dsm':2A,20B,86C 'execut':60B 'extern':70C 'file':13A,50B,65B,73C,102C 'flaw':5A,31B 'handl':30B 'host':25B 'infrastructur':21B 'let':6A,40B 'locat':53B 'log':8A,47B 'logged-in':7A 'manag':39B,85C 'media':3A,34B,80C 'name':74C 'nas':22B 'parser':4A,35B,81C 'path':29B,76C 'path-handl':28B 'reach':63B 'remot':42B,96C 'self':24B 'self-host':23B 'sourc':55B 'synolog':1A,26B,37B,83C 'unknown':68B 'user':10A,43B,98C 'vulner':77C 'write':11A,49B,66B,100C","nicknames":[],"mitigations":[],"who_affected":"Systems running Synology DiskStation Manager before 7.3.2-86009-5 or 7.4.1-90080-1 are in scope. Exposure requires an authenticated remote account, so instances without user accounts open to outsiders are less exposed. The sources do not say whether the Media Parser is enabled by default.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dsm","infrastructure","medium","nas","selfhosted","synology"],"campaign_type":null,"search_a":"'-16550':16A,19A '-2026':15A,18A 'arbitrari':12A 'cve':14A,17A 'dsm':2A 'file':13A 'flaw':5A 'let':6A 'log':8A 'logged-in':7A 'media':3A 'parser':4A 'synolog':1A 'user':10A 'write':11A","search_b":"'alreadi':46B 'arbitrari':52B 'beyond':64B 'code':59B 'describ':58B 'diskstat':38B 'dsm':20B 'execut':60B 'file':50B,65B 'flaw':31B 'handl':30B 'host':25B 'infrastructur':21B 'let':40B 'locat':53B 'log':47B 'manag':39B 'media':34B 'nas':22B 'parser':35B 'path':29B 'path-handl':28B 'reach':63B 'remot':42B 'self':24B 'self-host':23B 'sourc':55B 'synolog':26B,37B 'unknown':68B 'user':43B 'write':49B,66B","search_c":"'-1':94C '-5':90C '-86009':89C '-90080':93C '7.3.2':88C '7.4.1':92C 'allow':95C 'arbitrari':101C 'authent':97C 'control':71C 'diskstat':84C 'dsm':86C 'extern':70C 'file':73C,102C 'manag':85C 'media':80C 'name':74C 'parser':81C 'path':76C 'remot':96C 'synolog':83C 'user':98C 'vulner':77C 'write':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"security@synology.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16550","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16550","severity":null,"published_at":"2026-11-12T04:17:18+00:00","modified_at":"2026-11-12T04:17:18+00:00","first_seen_at":"2026-11-12T04:47:08+00:00","fetched_at":"2026-11-12T04:47:08+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}