Synology Synology's mission is to manage and protect the world’s data

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Synology product.

RSS Feeds for Synology security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Synology products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Synology Sorted by Most Security Vulnerabilities since 2018

Synology Diskstation Manager94 vulnerabilities

Synology Router Manager55 vulnerabilities

Synology Photo Station23 vulnerabilities

Synology Skynas16 vulnerabilities

Synology Calendar10 vulnerabilities

Synology Download Station7 vulnerabilities

Synology Note Station6 vulnerabilities

Synology Media Server6 vulnerabilities

Synology Drive Server6 vulnerabilities

Synology Drive Client6 vulnerabilities

Synology Dns Server5 vulnerabilities

Synology Ssl Vpn Client5 vulnerabilities

Synology Active Backup Business Agent5 vulnerabilities

Synology Audio Station3 vulnerabilities

Synology Virtual Diskstation Manager3 vulnerabilities

Synology Usb Copy1 vulnerability

Synology Sso Server1 vulnerability

Synology Photos1 vulnerability

Synology Active Backup Microsoft 3651 vulnerability

By the Year

In 2026 there have been 26 vulnerabilities in Synology with an average score of 6.1 out of ten. Last year, in 2025 Synology had 24 security vulnerabilities published. That is, 2 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.38

Year	Vulnerabilities	Average Score
2026	26	6.09
2025	24	6.47
2024	29	6.05
2023	11	7.67
2022	35	7.78
2021	35	7.87
2020	22	7.26
2019	37	6.48
2018	30	6.72

It may take a day or so for new Synology vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Synology Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2024-47263	Jun 03, 2026	Synology Hyper Backup PT: admin can write files (<4.1.2-4036) An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users with administrator privileges to write specific files containing non-sensitive information via unspecified vectors.
CVE-2024-47273	Jun 03, 2026	Path Traversal in Synology Hyper Backup pre-4.1.2-4036 via Backup Task An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users to write specific files via unspecified vectors.
CVE-2022-49036	Jun 03, 2026	Arbitrary Code Exec via Untrusted OpenSSL Config in Active Backup <= 2.5.0-2081 An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users to execute arbitrary code via unspecified vectors.
CVE-2022-49042	Jun 03, 2026	Synology Hyper Backup Explorer <3.0.1-0156 MinGW DLL Arbitrary Code Exec An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows local users to execute arbitrary code via unspecified vectors.
CVE-2023-52951	Jun 03, 2026	Synology Note Station Client <2.2.4-703: Cleartext Credential Transmission A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain user credential.	Note Station
CVE-2026-2237	May 27, 2026	Synology Storage Manager <1.0.1-1100: GET Query Strings Info Disclosure A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive information.
CVE-2025-66593	May 27, 2026	Synology Assistant <7.0.6: Local File Write via Origin Validation An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation.
CVE-2025-66592	May 27, 2026	Synology Active Backup Prior 3.1.0-4967: Origin Validation File Write An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation.	Active Backup Business Agent
CVE-2025-30028	May 27, 2026	Synology Active Backup for Business: Unauth File Read Vulnerability A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files.
CVE-2025-14713	May 27, 2026	Synology C2 Edge Server: Credential Exposure in DSM <1.76.00307 An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain user credentials from the edge server.
CVE-2025-13593	May 27, 2026	Local File Write in Synology ActiveProtect Agent < v1.1.0-0439 Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation.
CVE-2025-12686	May 27, 2026	Synology BeeStation Manager BSM Buffer Overflow in AdminCenter Before 1.3.2-65648 Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2025-13392	May 27, 2026	Synology DSM SSO Auth Bypass (<=7.2.2, <=7.3.1) Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote attackers to bypass authentication with prior knowledge of the distinguished name (DN).	Diskstation Manager
CVE-2025-13167	May 27, 2026	Synology Contacts XSS via contact form before 1.0.10-20659 - CVE-2025-13167 Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functionality in Synology Contacts before 1.0.10-20659 allows remote authenticated users to read or write specific files containing non-sensitive information via unspecified vectors.
CVE-2025-10466	May 27, 2026	CVE-2025-10466: XSS in Synology Safe Access <1.3.1-0329 (SRM) Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Safe Access in Synology Safe Access before 1.3.1-0329 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information or conduct limited denial-of-service in SRM.
CVE-2024-47272	May 27, 2026	Synology Surveillance Station 9.2.2 Auth Bypass Limiting File Write Incorrect authorization vulnerability in IO Module functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to limited file write via unspecified vectors.
CVE-2024-47271	May 27, 2026	Synology Surveillance Station 9.2.2-11575 IP Speaker cred leak remote admin Insufficiently protected credentials vulnerability in IPSpeaker component in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to obtain sensitive information via unspecified vectors.
CVE-2024-47270	May 27, 2026	Synology Surveillance Station 9.2.2 Improper Permission Preservation (ArchPush) Improper preservation of permissions vulnerability in Archiving Push functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to limited file write via unspecified vectors.
CVE-2024-47269	May 27, 2026	Synology Surveillance Station <9.2.2: Export Key Cleartext Transmission Leak Cleartext transmission of sensitive information vulnerability in Export Key functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to obtain sensitive information via unspecified vectors.
CVE-2024-47268	May 27, 2026	Missing Auth in Synology Surveillance Station AddOns (v<9.2.2-11575 & 9.2.2-9575) Missing authorization vulnerability in AddOns functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to obtain sensitive information via unspecified vectors.
CVE-2024-47267	May 27, 2026	Synology Surveillance Station <=9.2.2 Path Traversal via Archiving Pull Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Archiving Pull functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to limited file write via unspecified vectors.
CVE-2024-11399	May 27, 2026	BeeDrive Desktop <=1.3.2: redis-server Files Exposure (CWE-22) Files or directories accessible to external parties vulnerability in redis-server component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to conduct denial-of-service attacks via unspecified vectors.
CVE-2023-52945	May 27, 2026	Synology BeeDrive <1.3.2-13814: Unctrl Search Path Elem in OpenSSL DLL -> Local Code Exec Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to execute arbitrary code via unspecified vectors.
CVE-2021-47961	Apr 10, 2026	Synology SSL VPN Client <1.4.5 plaintext password storage vuln A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence the user's PIN code due to insecure storage. This may lead to unauthorized VPN configuration and potential interception of subsequent VPN traffic when combined with user interaction.	Ssl Vpn Client
CVE-2021-47960	Apr 10, 2026	Synology SSL VPN Client <1.4.5-0684: HTTP Loopback Disclosure (CVE-2021-47960) A files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access files within the installation directory via a local HTTP server bound to the loopback interface. By leveraging user interaction with a crafted web page, attackers may retrieve sensitive files such as configuration files, certificates, and logs, leading to information disclosure.	Ssl Vpn Client
CVE-2026-3091	Feb 24, 2026	Synology Presto Client <2.1.3-0672 UNC Search Path Vulnerability An uncontrolled search path element vulnerability in Synology Presto Client before 2.1.3-0672 allows local users to read or write arbitrary files and conduct denial-of-service during installation by placing a malicious DLL in advance in the same directory as the installer.
CVE-2025-8074	Dec 04, 2025	BeeDrive Desktop <1.4.3: Local User Arbitrary File Write via Origin Validation Origin validation error vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.3-13973 allows local users to write arbitrary files with non-sensitive information via unspecified vectors.
CVE-2025-54160	Dec 04, 2025	Synology BeeDrive <1.4.2-13960 Path Traversal allows local code execution Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.
CVE-2025-54159	Dec 04, 2025	BeeDrive Desktop <1.4.2-13960: Missing Auth Allows Remote File Delete Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attackers to delete arbitrary files via unspecified vectors.
CVE-2025-54158	Dec 04, 2025	Missing Auth in Synology BeeDrive Desktop <1.4.2-13960 allows local code exec Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.
CVE-2025-2848	Dec 04, 2025	Synology Mail Server Auth Auth Lets Adversary Edit Config (CVE-2025-2848) A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings, and disable some non-critical functions.
CVE-2025-29846	Dec 04, 2025	Portenable CGI Remote Authenticated Package Status Disclosure A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages.	Router Manager
CVE-2025-29845	Dec 04, 2025	VideoPlayer2 Subtitle CGI Authenticated File Disclosure A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files.	Router Manager
CVE-2025-29844	Dec 04, 2025	Synology FileStation Cgi: Remote Authenticated Path & Metadata Disclosure A vulnerability in FileStation file cgi allows remote authenticated users to read file metadata and path information.	Router Manager
CVE-2025-29843	Dec 04, 2025	Synology FileStation CGI R/W Access via thumb (CVE-2025-29843) A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files.	Router Manager
CVE-2024-5401	Dec 04, 2025	Synology DSM WebAPI CVE-2024-5401: Improper Code Resource Control pre-7.1.1-42962-8, pre-7.2.1-69057 Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote authenticated users to obtain privileges without consent via unspecified vectors.	Diskstation Manager
CVE-2024-45539	Dec 04, 2025	Out-of-bound write in Synology DSM CGI before 7.2.1 (DoS) Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to conduct denial-of-service attacks via unspecified vectors.	Diskstation Manager
CVE-2024-45538	Dec 04, 2025	Synology DSM WebAPI CSRF CVE-2024-45538 (before 7.2.1/7.2.2) Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors.	Diskstation Manager
CVE-2025-58463	Nov 07, 2025	Path Traversal in Synology Download Station 5.10.0.304+ A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: Download Station 5.10.0.305 ( 2025/09/16 ) and later Download Station 5.10.0.304 ( 2025/09/08 ) and later	Download Station
CVE-2025-58465	Nov 07, 2025	XSS in Download Station v<5.10.0.304> - remote account bypass A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: Download Station 5.10.0.305 ( 2025/09/16 ) and later Download Station 5.10.0.304 ( 2025/09/08 ) and later	Download Station
CVE-2024-53288	Jul 23, 2025	Synology Router Manager Prior to 1.3.1-9346-11 XSS via NTP Region Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in NTP Region functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified vectors.	Router Manager
CVE-2024-53286	Jul 23, 2025	Synology Router Manager DDNS RCE before 1.3.1-9346-11 Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to execute arbitrary code via unspecified vectors.	Router Manager
CVE-2024-53287	Jul 23, 2025	Synology Router Manager SRM <1.3.1-9346-11 XSS in VPN Settings Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in VPN Setting functionality in Synology Router Manager (SRM) before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified vectors.	Router Manager
CVE-2025-4679	May 16, 2025	Synology Active Backup for M365 Remote Authenticated Info Disclosure A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecified vectors.	Active Backup Microsoft 365
CVE-2024-50631	Mar 19, 2025	Synology Drive Server <3.0.4-12699 SQLi in sync daemon (SQL Injection) Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in the system syncing daemon in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to inject SQL commands, limited to write operations, via unspecified vectors.	Drive Server
CVE-2024-50630	Mar 19, 2025	Synology Drive Server webapi missing auth pre-3.5.1 Missing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to obtain administrator credentials via unspecified vectors.	Drive Server
CVE-2024-10441	Mar 19, 2025	Synology DSM 7.2 RCE via sysplugin Daemon XSS Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allows remote attackers to execute arbitrary code via unspecified vectors.	Diskstation Manager
CVE-2024-10444	Mar 19, 2025	Impr Cert Validation in DSM LDAP (v<7.2) – MITM Auth Hijack Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows man-in-the-middle attackers to hijack the authentication of administrators via unspecified vectors.	Diskstation Manager
CVE-2024-10445	Mar 19, 2025	Unvalidated Cert Allows Rmt Write in Synology BeeStation & DSM <1.1/6.2.4 Improper certificate validation vulnerability in the update functionality in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allow remote attackers to write limited files via unspecified vectors.	Diskstation Manager
CVE-2024-47265	Feb 13, 2025	Path Traversal via Unmount in Synology AB 2.7.1-13234/23234/3234 Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in encrypted share umount functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and 2.7.1-3234 allows remote authenticated users to write specific files via unspecified vectors.