CVE-2026-40535

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2

Description A path traversal issue exists in the Desktop API, where improper limitation of a pathname to a restricted directory allows remote attackers to write limited files and conduct limited denial-of-service attacks. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly neutralized.

Recommendations Update to version 7.2.1-69057-10 or later. Update to version 7.2.2-72806-7 or later. Update to version 7.3.2-86009-2 or later.