CVE-2026-40530

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2

Description An improper neutralization of CRLF sequences, known as CRLF injection, exists in the User API. This issue allows remote authenticated users to read or write arbitrary files and perform denial-of-service attacks following a system reboot. CRLF injection occurs when an application fails to properly filter Carriage Return (CR) and Line Feed (LF) characters, allowing an attacker to inject new lines into the output stream.

Recommendations Update to version 7.2.1-69057-10 or later. Update to version 7.2.2-72806-7 or later. Update to version 7.3.2-86009-2 or later.