CVE-2026-13683

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager (DSM) versions prior to 7.2.1-69057-12 Synology DiskStation Manager (DSM) versions prior to 7.2.2-72806-9 Synology DiskStation Manager (DSM) versions prior to 7.3.2-86009-4 Synology DiskStation Manager (DSM) versions prior to 7.4-90075

Description An SQL Injection issue exists in the EventScheduler API. This occurs due to improper neutralization of special elements used in an SQL command, allowing remote authenticated users with administrator privileges to obtain non-sensitive information.

Recommendations Update to version 7.2.1-69057-12 or later. Update to version 7.2.2-72806-9 or later. Update to version 7.3.2-86009-4 or later. Update to version 7.4-90075 or later.