CVE-2026-13666 in DiskStation Manager
Summary
by MITRE • 09/18/2026
An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write limited files when a victim clicks a sharing URL.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified as CRLF Injection in the Sharing API of Synology DiskStation Manager represents a significant security flaw within the web application layer, specifically affecting versions prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. This flaw stems from an improper neutralization of carriage return and line feed sequences within user-supplied input that is processed by the sharing functionality. When a remote authenticated user interacts with this API component, particularly through the generation or manipulation of sharing URLs, the system fails to adequately sanitize these control characters before including them in HTTP headers or response bodies. This lack of rigorous input validation allows an attacker to inject arbitrary CRLF sequences into the application's output stream, thereby altering the structure of the HTTP response itself rather than just its content body.
From a technical perspective, this vulnerability is classified under CWE-13, which denotes Improper Neutralization of CRLFs Within HTTP Headers. The core mechanism involves the injection of newline characters that terminate an existing header field and initiate a new one. In the context of web applications, headers such as Set-Cookie or Location are particularly susceptible to manipulation via this technique. By injecting these sequences, an attacker can effectively rewrite parts of the HTTP response sent back to the victim's browser. This capability is critical because it allows for the modification of how the client interprets subsequent data, potentially leading to session hijacking, cross-site scripting, or cache poisoning scenarios depending on which headers are targeted and what payload is injected following the CRLF sequence.
The operational impact of this vulnerability is characterized by its requirement for remote authentication combined with a social engineering component involving user interaction. While the attacker must be an authenticated user within the DSM environment, they do not need administrative privileges to exploit this flaw against other users or even themselves in certain contexts. The exploitation vector relies on tricking a victim into clicking a specially crafted sharing URL. Once clicked, the browser processes the manipulated HTTP response generated by the vulnerable API endpoint. This interaction can lead to limited file writes if the injected headers influence cookie settings that affect storage mechanisms, or more commonly, it facilitates attacks such as Cross-Site Scripting where malicious scripts are executed in the victim's context due to header manipulation affecting how content is rendered.
This vulnerability aligns with several ATT&CK techniques related to web application exploitation and credential access. Specifically, it relates to T1078 Valid Accounts, as authentication is required, and potentially T1562 Impair Defenses if the injection affects security headers like Content-Security-Policy or X-Frame-Options. Furthermore, if the CRLF injection leads to session cookie manipulation, it falls under T1539 Steal Web Session Cookie. The ability to write limited files suggests a potential for persistence or data exfiltration depending on the specific file system permissions and the nature of the injected content, although the primary risk remains in the alteration of client-side behavior through header injection.
Mitigation strategies must prioritize immediate patching as provided by Synology in DSM versions 7.2.1-69057-12 and later releases for respective branches. Administrators should verify their current version via the system update module and apply the latest security patches to ensure that input validation routines within the Sharing API are updated to properly encode or reject CRLF characters. In environments where immediate patching is not feasible, network-level controls such as Web Application Firewalls can be configured to detect and block HTTP responses containing anomalous header structures indicative of CRLF injection attempts. Additionally, implementing strict Content Security Policy headers can mitigate some downstream effects like cross-site scripting that might result from successful exploitation, although this does not address the root cause within the application code itself.