Critical [CVE-2026-13623 +7] improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write limited files
This critical-severity Synology advisory covers CVE-2026-13623 and CVE-2026-13635 and 6 more CVEs affecting DSM 7.4, DSM 7.3, DSM 7.2.2.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations. This bulletin covers 8 CVEs; its score, affected versions and guidance may apply to different issues within that bulletin.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Synology CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write limited files.
Affected products named by the advisory: DSM 7.4; DSM 7.3; DSM 7.2.2; DSM 7.2.1.
- before 7.2.1-69057-12
Official advisory · high-confidence parse· fetched 26 days ago·verify at source
- 7.2.1-69057-12
Official advisory · high-confidence parse· fetched 26 days ago·verify at source
Mitigation checklist
- Upgrade the affected Synology product to a fixed release: 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9, 7.2.1-69057-12.
Official advisory · high-confidence parse· fetched 26 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.