CVE-2026-92379 · Infrastructure
NO FIX YET · SEE WHAT TO DO
A cross-site-scripting-style input handling flaw in the Notification API of Synology DiskStation Manager lets an authenticated user read or write specific files. The sources give a CVSS score of 5.4 and say DSM versions before 7.3.2-86009-5 and 7.4.1-90080-1 are affected.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Owners of Synology DiskStation NAS devices running DSM before the fixed builds named in the sources. Exposure requires a valid DSM login; a team that does not run Synology NAS hardware can skip it.
Not affected if dsm-patched, no-synology-hardware
Who cares dsm, nas, self-hosted, synology
7.3.2-86009-5 and 7.4.1-90080-1.7.3.2-86009-5 or later7.4.1-90080-1 or laterAn improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.