DiskStation Manager (< 7.4.1-90080-1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/diskstation-manager--7.4.1-90080-1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 08:10:09 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSynology DiskStation Manager: Improper link resolution in thumb (CVE-2026-19048)https://feed.craftedsignal.io/briefs/2026-11-synology-dsm-vulnerability-cve-2026-19048/Thu, 12 Nov 2026 08:10:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-synology-dsm-vulnerability-cve-2026-19048/An improper link resolution vulnerability in the 'thumb' component of Synology DiskStation Manager allows an authenticated remote user to perform arbitrary file writes, potentially resulting in denial-of-service or system compromise.Synology DiskStation Manager (DSM) is affected by an improper link resolution before file access vulnerability (CVE-2026-19048) within the 'thumb' component. This vulnerability allows an authenticated remote attacker to write arbitrary files to the system, which may facilitate denial-of-service conditions or unauthorized modifications.

Impact

The vulnerability is assigned a CVSS v3.1 base score of 8.1. Successful exploitation by an authenticated remote attacker can lead to arbitrary file write operations, potentially resulting in system instability or denial-of-service.

Recommendation

Upgrade Synology DiskStation Manager (DSM) to version 7.3.2-86009-5 or later, or 7.4.1-90080-1 or later, to address the vulnerability documented in CVE-2026-19048.

]]>mediumadvisory