Vulnerability record/PUBLISHED/Published Nov 12, 2026 03:36:04 UTC
CVE-2026-13656
An improper neutralization of input during web page generation vulnerability in the Audio Player in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files.
Base score5.4/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredLowPR
User interactionRequiredUI
ScopeChangedS
Confidentiality impactLowC
Integrity impactLowI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authoritysynology
Last updatedNov 12, 2026 03:36:04 UTC
PublishedNov 12, 2026 03:36:04 UTC
ReservedJun 29, 2026 10:17:06 UTC
Credits
- HAK-MZ Team