CVE-2016-10331

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.5.3-3226

Description The issue allows remote attackers to read arbitrary files via a full pathname in the id parameter in the "download.php" file.

Recommendations For versions prior to 6.5.3-3226, update to version 6.5.3-3226 or later to resolve the issue. As a temporary workaround, consider restricting access to the "download.php" file until a patch is applied. Avoid using the id parameter in the affected API endpoint until the issue is resolved.