CVE-2026-13666 Synology CVE debrief

Who should care

Defenders responsible for Synology DSM installations, especially those with file sharing enabled, should assess exposure and prioritize remediation. This includes IT administrators, security teams, and operators who manage Synology DSM systems. They should review the vulnerability details, verify affected systems, and apply necessary updates or mitigations.

Why it matters

CVE-2026-13666 is a low-severity CRLF injection vulnerability in Synology DSM Sharing API that allows remote authenticated users to write limited files. Defenders should prioritize verifying and remediating this vulnerability, especially in environments with file sharing enabled.

• Limited file writes via sharing URL
• Potential for data tampering or unauthorized file creation
• Requires verification of Synology DSM versions and configurations
• Monitoring for suspicious sharing URL clicks and file writes

Technical summary

The vulnerability is caused by improper neutralization of CRLF sequences (CRLF Injection) in the Sharing API of Synology DiskStation Manager (DSM). This allows remote authenticated users to write limited files when a victim clicks a sharing URL. The affected products are Synology DSM versions before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. Defenders should prioritize verifying and remediating this vulnerability, especially in environments where file sharing is enabled. The vulnerability has a CVSS score of 3.5 and a severity of LOW.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in Synology DSM installations, especially in environments where file sharing is enabled.

Recommended defensive actions

• Verify Synology DSM versions and check for updates to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, or 7.4-90075.
• Review file sharing configurations and ensure proper validation of user input.
• Monitor for suspicious file writes and sharing URL clicks.
• Assess exposure and prioritize remediation, especially in environments with file sharing enabled.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The Synology security advisory (Synology_SA_26_13) may offer additional details. However, the advisory's contents are not publicly available. Defenders should verify Synology DSM versions and configurations, review file sharing settings, and monitor for suspicious activity. The CVE record was published on 2026-09-18T09:16:38.877Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.