MEDIUM 6.5 NVD

CVE-2026-4036

An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) befor

An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files.

References

https://www.synology.com/en-global/security/advisory/Synology_SA_26_06

Published: 2026-09-18 · Source: NVD · Feed updated: 2026-09-18

This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-09-18 via NVD.

vulnfeed aggregates 14509 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.