Synology Applications Vulnerabilities & Security Advisories
7 advisories tracked · Synology PSIRT ([email protected] CNA) via NVD · 0 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Synology advisory that VulniPulse classified as Applications, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 3 high, 4 medium.
Android app · Google Play
Monitor Synology CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
Synology PSIRT ([email protected] CNA) via NVD
Synology is its own CVE Numbering Authority. VulniPulse ingests Synology's CVEs from the NVD CNA feed ([email protected]), grouped by their official Synology_SA_YY_NN advisory, then enriches each from the advisory page — a fully server-rendered page carrying Synology's own severity rating, the affected-product / fixed-release table and the mitigation section. Covers DSM (DiskStation Manager), SRM (Router Manager), BeeStation, Synology Photos, Surveillance Station, Synology Drive and the SSL VPN Client.
Latest Synology Applications advisories
High [CVE-2022-49042] inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup…
An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows local users to execute arbitrary code via unspecified vectors.
High [CVE-2022-49036] inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for…
An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users to execute arbitrary code via unspecified vectors.
Medium [CVE-2024-47273] Hyper Backup: improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in…
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users to write specific files via unspecified vectors.
Medium [CVE-2024-47263] Hyper Backup: improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi…
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup. Repository webapi component in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users with administrator privileges to write specific files containing non-sensitive information via unspecified vectors.
High [CVE-2025-30028] vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files
A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files. Affected products named by the advisory: Active Backup for Business for DSM 7.2; Active Backup for Business for DSM 7.1; Active Backup for Business for DSM 6.2.
Medium [CVE-2025-66592] origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation
Synology has released a security update for the Active Backup for Business Agent on Windows to address a vulnerability: CVE-2025-66592 allows local users to write arbitrary files with restricted content. Please refer to the ' Affected product named by the advisory: Synology Active Backup for Business Agent.
Medium [CVE-2024-47267 +5] Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Archiving Pull functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to limited file write via unspecified vectors
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Archiving Pull functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to limited file write via unspecified vectors. Affected products named by the advisory: Surveillance Station for DSM 7.2; Surveillance Station for DSM 7.1; Surveillance Station for DSM 6.2.