CRLF Injection in Synology DSM 7.x Sharing API (v<7.2.1,7.2.2,7.3.2,7.4)
CVE-2026-13666 Published on September 18, 2026
An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write limited files when a victim clicks a sharing URL.
Vulnerability Analysis
CVE-2026-13666 is exploitable with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
What is a CRLF Injection Vulnerability?
The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
CVE-2026-13666 has been classified to as a CRLF Injection vulnerability or weakness.
Products Associated with CVE-2026-13666
Want to know whenever a new CVE is published for Synology Diskstation Manager? stack.watch will email you.
Affected Versions
Synology DiskStation Manager (DSM):- Version 7.4 and below 7.4-90075 is affected.
- Version 7.3.2 and below 7.3.2-86009-4 is affected.
- Version 7.2.2 and below 7.2.2-72806-9 is affected.
- Version 7.2.1 and below 7.2.1-69057-12 is affected.
- Before 7.2.1 is unknown.