CVE Feed

    Dashboard / CVE / CVE-2026-74850

    CVE-2026-74850

    An improper limitation of a pathname to a restricted directory vulnerability in the contentextract in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read specific files.

    Published:Nov 12, 2026
    Last Modified:Nov 13, 2026
    EPS:Nov 12, 2026
    EPSS Score:0.00546
    CVSS Score:4.3

    Affected Products

    Vendor
    Synology
    Product
    Diskstation Manager

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-76954 (CVSS 9.8) — An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synolog…
    CVE-2026-85101 (CVSS 8.6) — An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation…
    CVE-2026-88266 (CVSS 4.3) — An external control of system or configuration setting vulnerability in the synomount in Synology DiskStation …
    CVE-2026-81559 (CVSS 4.3) — A missing authorization vulnerability in the TaskScheduler API in Synology DiskStation Manager (DSM) before 7.…
    CVE-2026-81558 (CVSS 4.3) — A missing authorization vulnerability in the SocketIo API in Synology DiskStation Manager (DSM) before 7.3.2-8…
    CVE-2026-77738 (CVSS 4.3) — A server-side request forgery vulnerability in the Credential API in Synology DiskStation Manager (DSM) before…
    CVE-2026-19414 (CVSS 4.3) — A missing authorization vulnerability in the Promotion API in Synology DiskStation Manager (DSM) before 7.3.2-…
    CVE-2026-85098 (CVSS 5.3) — A reachable assertion vulnerability in the synoscgi in Synology DiskStation Manager (DSM) before 7.3.2-86009-5…
    CVE-2026-124993 (CVSS 5.3) — An incorrect authorization vulnerability in the Security Advisor in Synology DiskStation Manager (DSM) before …
    CVE-2026-92379 (CVSS 5.4) — An improper neutralization of input during web page generation vulnerability in the Notification API in Synolo…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High