CVE-2026-13635 in DiskStation Manager
Summary
by MITRE • 09/18/2026
An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in Synology DiskStation Manager (DSM) versions prior to the specified patches represents a critical failure in input validation and output encoding mechanisms within the authentication API subsystem. This flaw, classified under CWE-80 as Improper Neutralization of Script-Related HTML Tags in a Web Page, allows remote attackers to manipulate how data is rendered or processed by the client application. The core technical issue stems from insufficient sanitization of user-supplied input before it is incorporated into dynamic content generation processes within the Auth API. When untrusted data enters this pipeline without proper encoding, it can alter the intended structure of the output, potentially leading to information leakage scenarios where sensitive contextual details or internal system states are exposed in a manner that bypasses standard security controls.
From an operational perspective, while the immediate impact is described as obtaining non-sensitive information, such vulnerabilities often serve as reconnaissance vectors for more severe attacks. By exploiting improper encoding, attackers can extract metadata, session identifiers, configuration parameters, or other auxiliary data points that reveal details about the network topology, installed packages, or user roles within the DSM environment. This aligns with ATT&CK technique T1087, Account Discovery, as well as T1592, Gather Victim Host Information, where adversaries collect information to support subsequent phases of an intrusion campaign. The ability to retrieve this data remotely without authentication underscores a significant weakness in the API's boundary defenses, allowing external actors to map out potential attack surfaces and identify further entry points for privilege escalation or full system compromise.
The presence of such flaws highlights the importance of rigorous input validation strategies across all web-facing components of network-attached storage systems. Developers must ensure that any data originating from users is strictly validated against expected formats and then encoded appropriately before being rendered in responses. This includes applying context-specific encoding rules to prevent interpretation as executable code or structural elements within the API response format. For organizations running affected versions, immediate mitigation involves upgrading Synology DiskStation Manager to version 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, or 7.4-90075 and later. These updates contain the necessary code corrections to enforce proper escaping mechanisms within the Auth API, thereby neutralizing the vector used for information disclosure. Until patches are applied, administrators should consider restricting access to DSM interfaces through network segmentation or firewall rules to limit exposure to untrusted networks.