PT-2026-21657 · Synology · Synology Presto Client

Sahil Shah · Published 2026-02-24 · Updated 2026-03-04 · CVE-2026-3091

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Synology Presto Client versions prior to 2.1.3-0672

Description A flaw exists in Synology Presto Client that allows local users to read or write arbitrary files during installation. This occurs because of an uncontrolled search path element. An attacker can exploit this by placing a malicious DLL in the same directory as the installer before installation begins.

Recommendations Update Synology Presto Client to version 2.1.3-0672 or later.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2026-3091

Affected Products

Synology Presto Client

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-3091 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3091 · Vendor Advisory
• https://synology.com/en-global/security/advisory/Synology_SA_26_02 · Vendor Advisory
• https://t.me/CVEtracker/45555 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2026276725106086057 · Twitter Post
• https://twitter.com/CVEnew/status/2026184609189478901 · Twitter Post
• https://t.me/cveNotify/154053 · Telegram Post