CVE-2026-40535 - Vulnerability Details - OpenCVE

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write limited files and conduct limited denial-of-service attacks.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00434.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.synology.com/en-global/security/advisory/Synology_SA_26_06

History

Fri, 18 Sep 2026 11:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 18 Sep 2026 08:45:00 +0000

Type	Values Removed	Values Added
Description		An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write limited files and conduct limited denial-of-service attacks.
Weaknesses		CWE-22
References		https://www.synology.com/en-global/security/advisory/Synology_SA_26_06
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: synology

Published: 2026-09-18T08:28:55.263Z

Updated: 2026-09-18T10:43:26.294Z

Reserved: 2026-04-14T01:01:14.607Z

Link: CVE-2026-40535

Vulnrichment

Updated: 2026-09-18T10:43:21.271Z

NVD

Status : Received

Published: 2026-09-18T09:16:40.960

Modified: 2026-09-18T11:17:10.830

Link: CVE-2026-40535

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-22

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40535", "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01", "state": "PUBLISHED", "assignerShortName": "synology", "dateReserved": "2026-04-14T01:01:14.607Z", "datePublished": "2026-09-18T08:28:55.263Z", "dateUpdated": "2026-09-18T10:43:26.294Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "affected": [{"vendor": "Synology", "product": "DiskStation Manager (DSM)", "versions": [{"version": "7.3", "status": "affected", "lessThan": "7.3.2-86009-2", "versionType": "semver"}, {"version": "7.2.2", "status": "affected", "lessThan": "7.2.2-72806-7", "versionType": "semver"}, {"version": "7.2.1", "status": "affected", "lessThan": "7.2.1-69057-10", "versionType": "semver"}, {"version": "0", "status": "unknown", "lessThan": "7.2.1", "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write limited files and conduct limited denial-of-service attacks."}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW", "version": "3.1"}}], "references": [{"url": "https://www.synology.com/en-global/security/advisory/Synology_SA_26_06", "name": "Synology-SA-26:06 DSM", "tags": ["vendor-advisory"]}], "credits": [{"lang": "en", "value": "Warisse Valentin (Aytio)", "type": "finder"}], "providerMetadata": {"orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01", "shortName": "synology", "dateUpdated": "2026-09-18T08:28:55.263Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-18T10:43:06.082634Z", "id": "CVE-2026-40535", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-18T10:43:26.294Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40535", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-18T10:43:06.082634Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-18T10:43:21.271Z"}}], "cna": {"credits": [{"lang": "en", "type": "finder", "value": "Warisse Valentin (Aytio)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Synology", "product": "DiskStation Manager (DSM)", "versions": [{"status": "affected", "version": "7.3", "lessThan": "7.3.2-86009-2", "versionType": "semver"}, {"status": "affected", "version": "7.2.2", "lessThan": "7.2.2-72806-7", "versionType": "semver"}, {"status": "affected", "version": "7.2.1", "lessThan": "7.2.1-69057-10", "versionType": "semver"}, {"status": "unknown", "version": "0", "lessThan": "7.2.1", "versionType": "semver"}], "defaultStatus": "affected"}], "references": [{"url": "https://www.synology.com/en-global/security/advisory/Synology_SA_26_06", "name": "Synology-SA-26:06 DSM", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write limited files and conduct limited denial-of-service attacks."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01", "shortName": "synology", "dateUpdated": "2026-09-18T08:28:55.263Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40535", "state": "PUBLISHED", "dateUpdated": "2026-09-18T10:43:26.294Z", "dateReserved": "2026-04-14T01:01:14.607Z", "assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01", "datePublished": "2026-09-18T08:28:55.263Z", "assignerShortName": "synology"}, "dataVersion": "5.2"}