CVE-2026-88266 · Vendor
NO FIX YET · SEE WHAT TO DO
A flaw in synomount, a component of Synology DiskStation Manager (DSM), lets a logged-in remote user write specific files on the NAS. The sources describe this as an external control of system or configuration setting weakness with a CVSS score of 4.3.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Owners of Synology NAS devices running DSM before the fixed versions are exposed, but only to users who already have an account on the device. Systems where DSM is not used, or where account access is tightly restricted, carry less risk. The sources do not describe further configuration requirements.
Not affected if dsm-patched, no-user-accounts-exposed
Who cares dsm, nas, self-hosted, synology
7.3.2-86009-5 is affected; move to 7.3.2-86009-5 or later7.4.1-90080-1 is affected; move to 7.4.1-90080-1 or laterAn external control of system or configuration setting vulnerability in the synomount in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.