CVE-2026-19048 · Infrastructure
NO FIX YET · SEE WHAT TO DO
An improper link resolution flaw in the thumbnail component of Synology DiskStation Manager lets a logged-in user write files to arbitrary locations and crash the service. The sources rate it high severity (CVSS 8.1) but report no active exploitation.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only Synology DiskStation Manager systems where a user has a valid account can reach the thumbnail component. Systems running a fixed DSM build on each branch, or with no untrusted accounts, are less exposed. The sources do not name the exact thumbnail feature or its default settings.
Not affected if fixed-dsm-version, no-authenticated-users
Who cares dsm, nas, self-hosted, synology
unknown for the exact command7.3.2-86009-5 or later on the 7.3.2 branch7.4.1-90080-1 or later on the 7.4.1 branchAn improper link resolution before file access vulnerability in the thumb in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.