CVE-2026-13666 Synology CVE debrief

Who should care

System administrators and security teams responsible for Synology DiskStation Manager (DSM) deployments should assess exposure and prioritize verification for authenticated users with sharing URL access.

Why it matters

CVE-2026-13666 is a low-severity vulnerability in Synology DiskStation Manager (DSM) that allows authenticated users to write limited files via Sharing API. System administrators and security teams should assess exposure, prioritize verification, and update DSM to mitigate potential risks.

• Limited file write capabilities for authenticated users.
• Potential for data tampering or unauthorized changes.
• Requires verification of affected systems and user access.
• Remediation priority for DSM updates.

Technical summary

CVE-2026-13666 is an improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API of Synology DiskStation Manager (DSM). The vulnerability allows remote authenticated users to write limited files when a victim clicks a sharing URL. This can lead to potential data tampering or unauthorized changes. System administrators and security teams should assess exposure and prioritize verification for authenticated users with sharing URL access. The vulnerability affects Synology DiskStation Manager (DSM) versions before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075.

Defensive priority

Assess exposure and prioritize verification for authenticated users with sharing URL access.

Recommended defensive actions

• Review and update DiskStation Manager (DSM) to version 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 or 7.4-90075.
• Restrict access to sharing URLs for authenticated users.
• Monitor for suspicious activity related to Sharing API.
• Verify affected systems and user access.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• technicalSummary

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the full scope of affected systems and potential impact. Synology security advisories and official documentation should be reviewed for additional details. The vulnerability affects Synology DiskStation Manager (DSM) versions before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.