{"id":"CVE-2026-88266","kind":"vulnerability","aliases":["CVE-2026-88266"],"related":[],"title":"Synology DSM: authenticated users can write files via synomount","description":"An external control of system or configuration setting vulnerability in the synomount in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files.","summary":"A flaw in synomount, a component of Synology DiskStation Manager (DSM), lets a logged-in remote user write specific files on the NAS. The sources describe this as an external control of system or configuration setting weakness with a CVSS score of 4.3.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dsm","nas","self-hosted","synology","vendor"],"not_affected_if":["dsm-patched","no-user-accounts-exposed"],"how_to_check":"- Open DSM and check the installed version under Control Panel > Info Center (unknown path if the sources do not say more)\n- Compare the installed version with the fixed versions listed below","fix":"- DSM before `7.3.2-86009-5` is affected; move to `7.3.2-86009-5` or later\n- DSM before `7.4.1-90080-1` is affected; move to `7.4.1-90080-1` or later","status":"open","published_at":"2026-11-12T04:17:22+00:00","first_seen_at":"2026-11-12T04:47:10+00:00","triaged_at":"2026-11-12T04:48:01+00:00","updated_at":"2026-11-12T04:48:01+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-12T04:48:01Z","model":"claude-haiku-5-5","output":{"fix":"- DSM before `7.3.2-86009-5` is affected; move to `7.3.2-86009-5` or later\n- DSM before `7.4.1-90080-1` is affected; move to `7.4.1-90080-1` or later","reach":"network","title":"Synology DSM: authenticated users can write files via synomount","impact":"medium","summary":"A flaw in synomount, a component of Synology DiskStation Manager (DSM), lets a logged-in remote user write specific files on the NAS. The sources describe this as an external control of system or configuration setting weakness with a CVSS score of 4.3.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["synology","dsm","self-hosted","nas"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user writes files they should not control","analyst_note":"Check Synology's security advisory for CVE-2026-88266 to confirm which files can be written and whether the fixed versions above are the complete set.","how_to_check":"- Open DSM and check the installed version under Control Panel > Info Center (unknown path if the sources do not say more)\n- Compare the installed version with the fixed versions listed below","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["dsm-patched","no-user-accounts-exposed"],"who_is_affected":"Owners of Synology NAS devices running DSM before the fixed versions are exposed, but only to users who already have an account on the device. Systems where DSM is not used, or where account access is tightly restricted, carry less risk. The sources do not describe further configuration requirements.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00075,"input_tokens":4526,"output_tokens":595,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1':91C '-2026':11A,14A '-5':87C '-86009':86C '-88266':12A,15A '-90080':90C '4.3':66B '7.3.2':85C '7.4.1':89C 'allow':92C 'authent':3A,94C 'compon':28B 'configur':58B,73C 'control':54B,69C 'cve':10A,13A 'cvss':63B 'describ':49B 'diskstat':31B,81C 'dsm':2A,16B,33B,83C 'extern':53B,68C 'file':7A,43B,99C 'flaw':24B 'host':20B 'let':34B 'log':37B 'logged-in':36B 'manag':32B,82C 'nas':17B,46B 'remot':39B,93C 'score':64B 'self':19B 'self-host':18B 'set':59B,74C 'sourc':48B 'specif':42B,98C 'synolog':1A,21B,30B,80C 'synomount':9A,26B,78C 'system':56B,71C 'user':4A,40B,95C 'vendor':22B 'via':8A 'vulner':75C 'weak':60B 'write':6A,41B,97C","nicknames":[],"mitigations":[],"who_affected":"Owners of Synology NAS devices running DSM before the fixed versions are exposed, but only to users who already have an account on the device. Systems where DSM is not used, or where account access is tightly restricted, carry less risk. The sources do not describe further configuration requirements.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dsm","medium","nas","selfhosted","synology","vendor"],"campaign_type":null,"search_a":"'-2026':11A,14A '-88266':12A,15A 'authent':3A 'cve':10A,13A 'dsm':2A 'file':7A 'synolog':1A 'synomount':9A 'user':4A 'via':8A 'write':6A","search_b":"'4.3':66B 'compon':28B 'configur':58B 'control':54B 'cvss':63B 'describ':49B 'diskstat':31B 'dsm':16B,33B 'extern':53B 'file':43B 'flaw':24B 'host':20B 'let':34B 'log':37B 'logged-in':36B 'manag':32B 'nas':17B,46B 'remot':39B 'score':64B 'self':19B 'self-host':18B 'set':59B 'sourc':48B 'specif':42B 'synolog':21B,30B 'synomount':26B 'system':56B 'user':40B 'vendor':22B 'weak':60B 'write':41B","search_c":"'-1':91C '-5':87C '-86009':86C '-90080':90C '7.3.2':85C '7.4.1':89C 'allow':92C 'authent':94C 'configur':73C 'control':69C 'diskstat':81C 'dsm':83C 'extern':68C 'file':99C 'manag':82C 'remot':93C 'set':74C 'specif':98C 'synolog':80C 'synomount':78C 'system':71C 'user':95C 'vulner':75C 'write':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security@synology.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88266","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88266","severity":null,"published_at":"2026-11-12T04:17:22+00:00","modified_at":"2026-11-12T04:17:22+00:00","first_seen_at":"2026-11-12T04:47:10+00:00","fetched_at":"2026-11-12T04:47:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}