PT-2017-14272 · Synology · Synology Diskstation Manager

Published 2017-12-08 · Updated 2025-01-14 · CVE-2017-15894

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager (DSM) versions 6.0.x before 6.0.3-8754-3 Synology DiskStation Manager (DSM) versions 5.2-5967-6 and earlier

Description A directory traversal issue in the SYNO.FileStation.Extract component allows remote authenticated users to write arbitrary files via the dest folder path parameter. This enables attackers to potentially overwrite system files or create new files in unintended locations.

Recommendations For Synology DiskStation Manager (DSM) versions 6.0.x before 6.0.3-8754-3, update to version 6.0.3-8754-3 or later. For Synology DiskStation Manager (DSM) versions 5.2-5967-6 and earlier, update to version 5.2-5967-6 or later. As a temporary workaround, consider restricting access to the SYNO.FileStation.Extract component until a patch is applied. Avoid using the dest folder path parameter in the affected API endpoint until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-15894

Affected Products

Synology Diskstation Manager

References · 4

• https://synology.com/en-global/support/security/Synology_SA_17_70_DSM · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15894 · Security Note
• https://osv.dev/vulnerability/CVE-2017-15894 · Vendor Advisory
• https://t.me/cvenotify/107340 · Telegram Post