CVE-2026-13666

Executive Summary

CVE-2026-13666 is a CRLF injection (CWE-93) vulnerability in the Sharing API of Synology DiskStation Manager (DSM). A remote authenticated attacker can exploit improper neutralization of carriage return/line feed sequences to write limited files, but exploitation requires a victim to click a sharing URL, making it a user-interaction-dependent attack. The CVSS score of 3.5 reflects the constrained impact (low integrity only), authenticated privilege requirement, and UI:R factor; however, NAS devices frequently serve as centralized data stores, and file-write primitives—even limited—can undermine trust in shared content and enable follow-on abuse.

Technical Analysis

The NVD description states: "An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write limited files when a victim clicks a sharing URL."

CRLF injection (CWE-93) occurs when application input containing raw carriage-return (\r, 0x0D) and line-feed (\n, 0x0A) characters is not sanitized before being passed into a context where those characters have control semantics—most classically HTTP response headers, but also log files, configuration files, or structured text files. In this CVE, the injection surface is the Sharing API, and the outcome is the ability to write limited files, gated on a victim clicking a sharing URL.

No further implementation-level detail (function names, endpoint parameters, header names, or file path construction logic) is provided in the NVD description. Consistent with the strict-accuracy rules for this report, no such specifics are fabricated below. The vulnerability class allows the following class-level mechanism:

• The Sharing API processes user-supplied data (e.g., share naming, metadata, or redirect parameters) and, in some code path, embeds that data into a file-write operation without stripping CR/LF or other control characters.
• Because CRLF sequences carry structural meaning in many file formats and protocols (line terminators, header boundaries, directive delimiters), an attacker who can inject them may influence the structure or content of the resulting file rather than merely its data payload.
• The "limited files" qualifier implies the write target is constrained—likely a fixed set of files, restricted directory, or size/content-limited artifact—rather than arbitrary filesystem write. This constraint is what keeps the integrity impact at "Low" (I:L) and confines the CVSS scope to Unchanged (S:U).
• The UI:R (User Interaction: Required) component indicates the write is triggered or completed only when a victim activates a crafted sharing URL, making the attack a form of cross-context, victim-assisted file manipulation rather than a fully autonomous remote write.

Attack surface: DSM's Sharing API is exposed to authenticated users and is reachable over the network (AV:N). The attack is not pre-authentication (PR:L), so the adversary must already hold a valid DSM account with sharing privileges.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is available for CVE-2026-13666 (POC_STATUS: None). The following chain is inferred from the CRLF-injection vulnerability class and the NVD description, not from disclosed exploit artifacts. No function names, endpoints, or parameters are invented.

1. Reconnaissance / target identification. The attacker identifies an internet- or LAN-exposed Synology DSM instance vulnerable to CVE-2026-13666, i.e., running a build older than the fixed versions (7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, or 7.4-90075). DSM instances are commonly enumerated via Shodan using product:"Synology DiskStation Manager" or http.title:"Synology DiskStation".

2. Prerequisite access. The attacker obtains a low-privileged, authenticated DSM account (PR:L). This may be via credential reuse, phishing, purchase of leaked credentials, or a separate foothold. No authentication bypass is described in this CVE.

3. Triggering the flaw class (CRLF injection in the Sharing API). Through the Sharing API, the attacker crafts a share or share-related request whose data fields contain injected CRLF (%0d%0a) sequences. Because the application fails to neutralize these sequences before using the data in a file-write operation, the injected control characters alter the structure or content of the file being written. The "limited files" wording in the advisory constrains what the attacker can influence—the write is not arbitrary.

4. Victim-assisted completion. The attacker distributes the resulting sharing URL and induces a victim to click it (UI:R). On activation, the crafted share triggers the file-write side effect. Without victim interaction, the impact does not materialize under this CVE's scoring.

5. Post-exploitation impact. Per CVSS, only Integrity (I:L) is affected—the attacker can write limited files. There is no confidentiality (C:N) or availability (A:N) impact described. Plausible follow-on effects within that limited integrity scope include corrupting or reshaping shared file content, planting misleading content in files that surface in the sharing workflow, or abusing the write to prepare a secondary attack (e.g., influencing data later consumed by other users). These are class-level consequences; the advisory does not enumerate specific downstream effects.

Because no exploit-in-the-wild evidence, KEV listing, or public PoC exists, this remains a theoretical/low-urgency chain at time of writing.

Impact Assessment

• CVSS 3.1 Base Score: 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N.
  • AV:N (Network): Exploitable over the network—DSM Sharing API is remotely reachable.
  • AC:L (Low): No special conditions beyond what is described; the flaw is reliably triggerable given the prerequisites.
  • PR:L (Low privileges): Requires an authenticated DSM account; not pre-auth.
  • UI:R (User Interaction Required): A victim must click a sharing URL for impact to occur.
  • S:U (Unchanged): Impact is confined to the vulnerable component's security scope.
  • C:N / I:L / A:N: No confidentiality or availability impact; limited integrity impact (write of limited files).
• Business impact: Impact is constrained but non-trivial. Synology NAS units are frequently central repositories for backups, shared documents, and collaboration data. A limited file-write primitive can degrade data integrity in shared content and undermine user trust in the Sharing workflow. It may also serve as a stepping stone in a multi-stage intrusion where the attacker already holds credentials.
• Blast radius: Any DSM deployment older than the fixed builds with the Sharing API enabled is in scope. Organizations exposing DSM to the internet and permitting broad account issuance have the largest exposure surface.
• Urgency: Low, driven by the 3.5 score and UI:R prerequisite. EPSS is not yet scored by FIRST.org (no value fabricated here). CVE is not in CISA KEV.

Detection Guidance

Sigma Rule

Detects anomalous CRLF-encoded sequences in requests to DSM sharing-related endpoints in web/proxy logs.

title: Synology DSM CRLF Injection Attempt in Sharing API (CVE-2026-13666)
id: 8b1f3d7a-2c94-4e6b-9a55-0f9c1d2e3a44
status: experimental
description: Detects HTTP requests containing URL-encoded CRLF sequences targeting Synology DSM sharing endpoints, consistent with CVE-2026-13666 exploitation attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-13666
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/sharing'
      - '/webapi/entry.cgi'
  selection_crlf:
    cs-uri-query|contains:
      - '%0d%0a'
      - '%0D%0A'
      - '%0a%0d'
      - '\r\n'
  condition: selection_path and selection_crlf
falsepositives:
  - Legitimate applications that encode newlines in structured data parameters
level: medium
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026-13666

YARA Rule

Detects CRLF-injection payload artifacts in captured HTTP request data or logs referencing DSM sharing paths.

rule CVE_2026_13666_Synology_DSM_CRLF_Injection
{
    meta:
        description = "Detects CRLF injection payloads targeting Synology DSM Sharing API (CVE-2026-13666)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-13666"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $crlf_enc1 = "%0d%0a" nocase
        $crlf_enc2 = "%0D%0A" nocase
        $crlf_enc3 = "%0a%0d" nocase
        $share1   = "/sharing" nocase
        $share2   = "webapi/entry.cgi" nocase
        $syno     = "Synology" nocase

    condition:
        (any of ($crlf_enc*)) and (any of ($share*, $syno))
}

Suricata IDS Rule

Network detection for CRLF sequences in requests to DSM sharing paths.

alert http any any -> any any (msg:"CVE-2026-13666 Synology DSM CRLF Injection in Sharing API"; flow:established,to_server; http.uri; content:"/sharing"; nocase; http.uri; content:"%0d%0a"; nocase; sid:202613666; rev:1; reference:cve,2026-13666; classtype:attempted-user; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

EQL rule flagging web requests with encoded CRLF to DSM sharing endpoints.

sequence by host.id
  [ network where event.type == "start"
      and network.protocol == "http"
      and url.path : ("*sharing*" or "*webapi/entry.cgi*")
      and url.query : ("*%0d%0a*" or "*%0d%0A*" or "*%0a%0d*") ]

Splunk SPL Query

Splunk search for CRLF injection attempts in proxy/webserver logs.

index=web OR index=proxy
(uri_path="*sharing*" OR uri_path="*webapi/entry.cgi*" OR url="*sharing*")
(uri_query="*%0d%0a*" OR uri_query="*%0D%0A*" OR uri_query="*%0a%0d*" OR url="*%0d%0a*" OR url="*%0D%0A*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_host, uri_path, uri_query
| where count > 0
| sort - count

Wazuh OSSEC Rule

Wazuh rule matching DSM access logs for encoded CRLF in sharing URLs.

<group name="web,synology,cve-2026-13666">
  <rule id="20261366" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>\/sharing|webapi\/entry\.cgi</url>
    <regex>%0[dD]%0[aA]|%0[aA]%0[dD]</regex>
    <description>CVE-2026-13666: Possible CRLF injection attempt against Synology DSM Sharing API</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,cve_2026_13666,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source). Vendor advisory text references fixed builds, but no tracked patch source confirms deployable fixes for all branches; treat as unpatched until verified against Synology's official advisory.

1. Immediate mitigations

   • Restrict Sharing API access to trusted networks; avoid internet exposure of DSM where feasible.
   • Enforce least privilege on DSM accounts—limit who can create and distribute sharing URLs.
   • Treat sharing URLs from untrusted sources with caution; user click is required for exploitation (UI:R), so user awareness reduces exposure.
   • Deploy the detection rules above (Sigma, Suricata, Elastic, Splunk, Wazuh) to catch encoded CRLF sequences targeting sharing paths.
   • Monitor for unexpected writes or anomalies in files surfaced by the Sharing workflow.

2. Patch / upgrade steps

   • Consult Synology's official security advisory for CVE-2026-13666 and apply the fixed DSM builds: 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, or 7.4-90075 (or later).
   • Verify current DSM version before and after upgrade; stage in a non-production unit where possible.
   • Monitor Synology release notes for updated firmware if your branch is not yet covered.

3. Long-term hardening

   • Integrate DSM update management into a patch cadence; subscribe to Synology security advisories.
   • Enforce MFA on all DSM accounts to raise the cost of obtaining the PR:L prerequisite.
   • Segment NAS devices from general user networks and restrict management/share interfaces via firewall rules.
   • Log and review Sharing API usage; alert on unusual share creation patterns or abnormal URL parameters.

References

• NVD — CVE-2026-13666: https://nvd.nist.gov/vuln/detail/CVE-2026-13666
• Synology Security Advisory (check Synology Security Advisory portal for the DSM advisory referencing CVE-2026-13666): https://www.synology.com/en-global/security/advisory
• MITRE CWE-93 — Improper Neutralization of CRLF Sequences ('CRLF Injection'): https://cwe.mitre.org/data/definitions/93.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-13666 not listed as of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (no score yet available for CVE-2026-13666): https://www.first.org/epss/

Threat actor campaigns / exploit-in-the-wild evidence: None identified. No public PoC, no Nuclei template, no exploit code, and no CISA KEV listing at time of writing.