{"id":"CVE-2026-81557","kind":"vulnerability","aliases":["CVE-2026-81557"],"related":[],"title":"Synology DSM: DSMNotify input flaw lets logged-in users read or write files","description":"An improper neutralization of input during web page generation vulnerability in the DSMNotify in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files.","summary":"A web page generation flaw in DSMNotify, a component of Synology DiskStation Manager, lets an authenticated user read or write specific files on the NAS. The attacker must already have a valid account on the device.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dsm","infrastructure","nas","self-hosted","synology"],"not_affected_if":["dsm-patched","dsmnotify-not-installed"],"how_to_check":"- Open DSM and check the installed version under Control Panel > Info Center; compare it with `7.3.2-86009-5` and `7.4.1-90080-1`\n- Confirm whether DSMNotify is installed and enabled under Package Center","fix":"- Synology DiskStation Manager 7.3.x: move to `7.3.2-86009-5` or later\n- Synology DiskStation Manager 7.4.x: move to `7.4.1-90080-1` or later","status":"open","published_at":"2026-11-12T04:17:20+00:00","first_seen_at":"2026-11-12T04:47:09+00:00","triaged_at":"2026-11-12T04:47:56+00:00","updated_at":"2026-11-12T04:47:56+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-12T04:47:56Z","model":"claude-haiku-5-5","output":{"fix":"- Synology DiskStation Manager 7.3.x: move to `7.3.2-86009-5` or later\n- Synology DiskStation Manager 7.4.x: move to `7.4.1-90080-1` or later","reach":"network","title":"Synology DSM: DSMNotify input flaw lets logged-in users read or write files","impact":"medium","summary":"A web page generation flaw in DSMNotify, a component of Synology DiskStation Manager, lets an authenticated user read or write specific files on the NAS. The attacker must already have a valid account on the device.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["synology","dsm","nas","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reads or writes specific files on the NAS","analyst_note":"","how_to_check":"- Open DSM and check the installed version under Control Panel > Info Center; compare it with `7.3.2-86009-5` and `7.4.1-90080-1`\n- Confirm whether DSMNotify is installed and enabled under Package Center\n- unknown for anything beyond these checks","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["dsm-patched","dsmnotify-not-installed"],"who_is_affected":"Any Synology NAS running DSM before the fixed builds where DSMNotify is present. Exposure needs a valid DSM user account, so systems without shared or untrusted user accounts carry less risk. Devices with no user accounts beyond the administrator are lower risk but should still be patched.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000759,"input_tokens":4535,"output_tokens":610,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1':89C '-2026':16A,19A '-5':85C '-81557':17A,20A '-86009':84C '-90080':88C '7.3.2':83C '7.4.1':87C 'account':60B 'allow':90C 'alreadi':56B 'attack':54B 'authent':43B,92C 'compon':36B 'cve':15A,18A 'devic':63B 'diskstat':39B,79C 'dsm':2A,21B,81C 'dsmnotifi':3A,34B,76C 'file':14A,49B,99C 'flaw':5A,32B 'generat':31B,72C 'host':26B 'improp':65C 'infrastructur':22B 'input':4A,68C 'let':6A,41B 'log':8A 'logged-in':7A 'manag':40B,80C 'must':55B 'nas':23B,52B 'neutral':66C 'page':30B,71C 'read':11A,45B,95C 'remot':91C 'self':25B 'self-host':24B 'specif':48B,98C 'synolog':1A,27B,38B,78C 'user':10A,44B,93C 'valid':59B 'vulner':73C 'web':29B,70C 'write':13A,47B,97C","nicknames":[],"mitigations":[],"who_affected":"Any Synology NAS running DSM before the fixed builds where DSMNotify is present. Exposure needs a valid DSM user account, so systems without shared or untrusted user accounts carry less risk. Devices with no user accounts beyond the administrator are lower risk but should still be patched.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dsm","infrastructure","medium","nas","selfhosted","synology"],"campaign_type":null,"search_a":"'-2026':16A,19A '-81557':17A,20A 'cve':15A,18A 'dsm':2A 'dsmnotifi':3A 'file':14A 'flaw':5A 'input':4A 'let':6A 'log':8A 'logged-in':7A 'read':11A 'synolog':1A 'user':10A 'write':13A","search_b":"'account':60B 'alreadi':56B 'attack':54B 'authent':43B 'compon':36B 'devic':63B 'diskstat':39B 'dsm':21B 'dsmnotifi':34B 'file':49B 'flaw':32B 'generat':31B 'host':26B 'infrastructur':22B 'let':41B 'manag':40B 'must':55B 'nas':23B,52B 'page':30B 'read':45B 'self':25B 'self-host':24B 'specif':48B 'synolog':27B,38B 'user':44B 'valid':59B 'web':29B 'write':47B","search_c":"'-1':89C '-5':85C '-86009':84C '-90080':88C '7.3.2':83C '7.4.1':87C 'allow':90C 'authent':92C 'diskstat':79C 'dsm':81C 'dsmnotifi':76C 'file':99C 'generat':72C 'improp':65C 'input':68C 'manag':80C 'neutral':66C 'page':71C 'read':95C 'remot':91C 'specif':98C 'synolog':78C 'user':93C 'vulner':73C 'web':70C 'write':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security@synology.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-81557","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81557","severity":null,"published_at":"2026-11-12T04:17:20+00:00","modified_at":"2026-11-12T04:17:20+00:00","first_seen_at":"2026-11-12T04:47:09+00:00","fetched_at":"2026-11-12T04:47:09+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}