{"id":"CVE-2026-92379","kind":"vulnerability","aliases":["CVE-2026-92379"],"related":[],"title":"Synology DSM: Notification API input flaw lets logged-in users read or write files","description":"An improper neutralization of input during web page generation vulnerability in the Notification API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files.","summary":"A cross-site-scripting-style input handling flaw in the Notification API of Synology DiskStation Manager lets an authenticated user read or write specific files. The sources give a CVSS score of 5.4 and say DSM versions before 7.3.2-86009-5 and 7.4.1-90080-1 are affected.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dsm","infrastructure","nas","self-hosted","synology"],"not_affected_if":["dsm-patched","no-synology-hardware"],"how_to_check":"- Check the installed DSM version in Control Panel > Info Center, and compare it with `7.3.2-86009-5` and `7.4.1-90080-1`.","fix":"- DSM 7.3 branch: `7.3.2-86009-5` or later\n- DSM 7.4 branch: `7.4.1-90080-1` or later","status":"open","published_at":"2026-11-12T04:17:22+00:00","first_seen_at":"2026-11-12T04:47:10+00:00","triaged_at":"2026-11-12T04:47:53+00:00","updated_at":"2026-11-12T04:47:53+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-12T04:47:53Z","model":"claude-haiku-5-5","output":{"fix":"- DSM 7.3 branch: `7.3.2-86009-5` or later\n- DSM 7.4 branch: `7.4.1-90080-1` or later","reach":"network","title":"Synology DSM: Notification API input flaw lets logged-in users read or write files","impact":"medium","summary":"A cross-site-scripting-style input handling flaw in the Notification API of Synology DiskStation Manager lets an authenticated user read or write specific files. The sources give a CVSS score of 5.4 and say DSM versions before 7.3.2-86009-5 and 7.4.1-90080-1 are affected.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["synology","dsm","nas","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reads or writes specific files on the NAS","analyst_note":"","how_to_check":"- Check the installed DSM version in Control Panel > Info Center, and compare it with `7.3.2-86009-5` and `7.4.1-90080-1`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["dsm-patched","no-synology-hardware"],"who_is_affected":"Owners of Synology DiskStation NAS devices running DSM before the fixed builds named in the sources. Exposure requires a valid DSM login; a team that does not run Synology NAS hardware can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000724,"input_tokens":4531,"output_tokens":541,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1':74B,103C '-2026':17A,20A '-5':70B,99C '-86009':69B,98C '-90080':73B,102C '-92379':18A,21A '5.4':62B '7.3.2':68B,97C '7.4.1':72B,101C 'affect':76B 'allow':104C 'api':4A,41B,90C 'authent':48B,106C 'cross':31B 'cross-site-scripting-styl':30B 'cve':16A,19A 'cvss':59B 'diskstat':44B,93C 'dsm':2A,22B,65B,95C 'file':15A,54B,113C 'flaw':6A,37B 'generat':85C 'give':57B 'handl':36B 'host':27B 'improp':78C 'infrastructur':23B 'input':5A,35B,81C 'let':7A,46B 'log':9A 'logged-in':8A 'manag':45B,94C 'nas':24B 'neutral':79C 'notif':3A,40B,89C 'page':84C 'read':12A,50B,109C 'remot':105C 'say':64B 'score':60B 'script':33B 'self':26B 'self-host':25B 'site':32B 'sourc':56B 'specif':53B,112C 'style':34B 'synolog':1A,28B,43B,92C 'user':11A,49B,107C 'version':66B 'vulner':86C 'web':83C 'write':14A,52B,111C","nicknames":[],"mitigations":[],"who_affected":"Owners of Synology DiskStation NAS devices running DSM before the fixed builds named in the sources. Exposure requires a valid DSM login; a team that does not run Synology NAS hardware can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dsm","infrastructure","medium","nas","selfhosted","synology"],"campaign_type":null,"search_a":"'-2026':17A,20A '-92379':18A,21A 'api':4A 'cve':16A,19A 'dsm':2A 'file':15A 'flaw':6A 'input':5A 'let':7A 'log':9A 'logged-in':8A 'notif':3A 'read':12A 'synolog':1A 'user':11A 'write':14A","search_b":"'-1':74B '-5':70B '-86009':69B '-90080':73B '5.4':62B '7.3.2':68B '7.4.1':72B 'affect':76B 'api':41B 'authent':48B 'cross':31B 'cross-site-scripting-styl':30B 'cvss':59B 'diskstat':44B 'dsm':22B,65B 'file':54B 'flaw':37B 'give':57B 'handl':36B 'host':27B 'infrastructur':23B 'input':35B 'let':46B 'manag':45B 'nas':24B 'notif':40B 'read':50B 'say':64B 'score':60B 'script':33B 'self':26B 'self-host':25B 'site':32B 'sourc':56B 'specif':53B 'style':34B 'synolog':28B,43B 'user':49B 'version':66B 'write':52B","search_c":"'-1':103C '-5':99C '-86009':98C '-90080':102C '7.3.2':97C '7.4.1':101C 'allow':104C 'api':90C 'authent':106C 'diskstat':93C 'dsm':95C 'file':113C 'generat':85C 'improp':78C 'input':81C 'manag':94C 'neutral':79C 'notif':89C 'page':84C 'read':109C 'remot':105C 'specif':112C 'synolog':92C 'user':107C 'vulner':86C 'web':83C 'write':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T04:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security@synology.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92379","severity":null,"published_at":"2026-11-12T04:17:22+00:00","modified_at":"2026-11-12T04:17:22+00:00","first_seen_at":"2026-11-12T04:47:10+00:00","fetched_at":"2026-11-12T04:47:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}