{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/diskstation-manager--7.4.1-90080-1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:synology:diskstation_manager:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-19048"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["DiskStation Manager (\u003c 7.3.2-86009-5)","DiskStation Manager (\u003c 7.4.1-90080-1)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Synology"],"content_html":"\u003cp\u003eSynology DiskStation Manager (DSM) is affected by an improper link resolution before file access vulnerability (CVE-2026-19048) within the 'thumb' component. This vulnerability allows an authenticated remote attacker to write arbitrary files to the system, which may facilitate denial-of-service conditions or unauthorized modifications.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability is assigned a CVSS v3.1 base score of 8.1. Successful exploitation by an authenticated remote attacker can lead to arbitrary file write operations, potentially resulting in system instability or denial-of-service.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade Synology DiskStation Manager (DSM) to version 7.3.2-86009-5 or later, or 7.4.1-90080-1 or later, to address the vulnerability documented in CVE-2026-19048.\u003c/p\u003e\n","date_modified":"2026-11-12T08:10:09Z","date_published":"2026-11-12T08:10:09Z","id":"https://feed.craftedsignal.io/briefs/2026-11-synology-dsm-vulnerability-cve-2026-19048/","summary":"An improper link resolution vulnerability in the 'thumb' component of Synology DiskStation Manager allows an authenticated remote user to perform arbitrary file writes, potentially resulting in denial-of-service or system compromise.","title":"Synology DiskStation Manager: Improper link resolution in thumb (CVE-2026-19048)","url":"https://feed.craftedsignal.io/briefs/2026-11-synology-dsm-vulnerability-cve-2026-19048/"}],"language":"en","title":"CraftedSignal Threat Feed - DiskStation Manager (\u003c 7.4.1-90080-1)","version":"https://jsonfeed.org/version/1.1"}