OCTOBER 12, 2026
Live Feed
Back to database
Case File

CVE-2026-6205

HIGH · CVSS 8.1 EPSS 0.52%

Source: NVD + CISA KEV + EPSS · Published 2026-09-18 · Last synced 2026-10-12

CyberRota Analysis

AI-Generated

The Upload API in Synology DiskStation Manager prior to specified versions is vulnerable to an external control of file name or path issue, allowing remote authenticated users to write arbitrary files. This can lead to potential denial-of-service attacks, compromising system integrity and availability. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.

CVE
CVE-2026-6205
Severity
HIGH
CVSS
8.1
EPSS
0.52%

Original NVD Description

An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks.