Description

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-18T09:16:39.237Z",
  "pubdate": "2026-09-18T09:16:39.237Z",
  "executiveSummary": "This vulnerability involves an improper encoding or escaping of output within the SCGI (Simple Common Gateway Interface) implementation of Synology DiskStation Manager (DSM).\nThe flaw allows remote, unauthenticated attackers to perform unauthorized read or write operations on arbitrary files within the system and execute denial-of-service (DoS) attacks.\nAffected products include Synology DSM versions prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075.\nThe risk is critical, as successful exploitation bypasses standard file system access controls, potentially leading to full system compromise, sensitive data exfiltration, or complete service disruption.\nThe vulnerability highlights a failure in the input/output sanitation process within the web gateway layer, permitting an attacker to manipulate server-side file operations through maliciously crafted SCGI packets.",
  "technicalDetails": "The root cause of the vulnerability resides in the insufficient sanitization of output data handled by the SCGI gateway within Synology DSM. SCGI is a protocol used to connect web servers to backend applications; in this context, the DSM web management interface fails to correctly encode or escape data streams before they are processed by the underlying system components.\nThe vulnerability allows for an injection-style attack where an attacker sends specifically crafted requests to the SCGI interface. By injecting control characters or path traversal sequences into the payload, the attacker influences how the backend process interprets file paths or system commands.\nThe attack flow proceeds as follows: First, the attacker identifies a public-facing service utilizing the vulnerable SCGI interface. Second, the attacker transmits a malformed payload designed to exploit the improper encoding. Because the SCGI implementation does not properly sanitize these inputs, the payload is passed to internal system functions that handle file I/O operations.\nWhen targeting file read operations, the attacker can leverage directory traversal sequences (e.g., '../') to access sensitive configuration files, credentials, or protected system data outside of the intended web root. Conversely, for write operations, the attacker may overwrite critical system configuration files or binary executables, potentially facilitating remote code execution or persistent backdoors.\nThe Denial-of-Service (DoS) vector is achieved by forcing the SCGI handler to process payloads that exhaust system resources, such as memory or file descriptors, or by overwriting essential files required for the DSM operating system to remain functional. This causes the web interface to crash or become unresponsive, effectively locking administrators out of the management console.\nExploitation does not require prior authentication, as the flaw exists at the entry point of the SCGI handler. The lack of strict input validation allows the attacker to manipulate the file system context with the privileges of the web service user, which often possesses elevated or sufficient permissions to modify core operational parameters. Network exposure is significant if the DSM management port is accessible over the public internet, making it a high-priority target for automated exploit scripts."
}