CVE-2026-13684

Executive Summary

CVE-2026-13684 is a critical improper output encoding/escaping vulnerability (CWE-116) in the SCGI interface of Synology DiskStation Manager (DSM), rated 9.8 on CVSS v3.1. The flaw allows unauthenticated remote attackers to read or write arbitrary files and to conduct denial-of-service attacks against affected NAS appliances. All DSM installations running versions prior to the fixed builds listed in the CNA description — spanning the 7.2.1, 7.2.2, 7.3.2, and 7.4 release trains — are exposed, making internet-facing Synology NAS devices the primary risk surface.

Technical Analysis

The vulnerability resides in DSM's SCGI (Simple Common Gateway Interface) handling layer. CWE-116 describes improper neutralization of special elements in output — the process by which data from one context (e.g., a request parameter, header, or environment variable) is emitted into another context (e.g., a filesystem path, an HTTP response body, or a shell-adjacent context) without the escaping/sanitization appropriate for the destination.

In the case of SCGI on DSM, the protocol is used to bridge front-end web requests to back-end management daemons. When output derived from attacker-controlled input is not correctly encoded before it reaches a downstream consumer (filesystem operations, subprocess arguments, or response framing), the class of impact observed here becomes reachable:

• Arbitrary file read — attacker-supplied data influences a path or identifier that the privileged back-end resolves without escaping, allowing traversal or substitution to reference unintended files.
• Arbitrary file write — the same class of unsanitized output enables writing attacker-chosen content to attacker-chosen locations, potentially establishing persistence or overwriting configuration.
• Denial of service — malformed or specially crafted input causes the SCGI handler or downstream consumer to fail, exhaust resources, or terminate critical services.

The NVD description does not enumerate specific endpoints, parameter names, or the exact escape function that is deficient; therefore this analysis deliberately stays at the class and mechanism level. No function names, API paths, or file paths are asserted here because none are provided in the source data. What is knowable with confidence:

1. The attack surface is the SCGI-facing management interface of DSM, reachable over the network (AV:N).
2. No privileges or user interaction are required (PR:N, UI:N).
3. Impact is total across confidentiality, integrity, and availability (C:H/I:H/A:H).

The combination of network reachability, no authentication requirement, and high CIA impact explains the 9.8 base score. The absence of a scope change (S:U) indicates the vulnerable component and impacted resources are within the same security authority.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for this CVE. The attack chain below is inferred strictly from the vulnerability class (CWE-116) and the stated impacts; it does not assert unverified implementation specifics.

1. Reconnaissance / target identification. An attacker identifies internet-exposed Synology DSM instances via Shodan or similar internet scanning using product:"Synology DiskStation Manager" and DSM management ports (5000/5001 HTTP/HTTPS). Version fingerprinting via DSM's login/API responses narrows candidates to pre-fix builds.

2. Triggering the flaw class. The attacker issues a network request to the SCGI-backed interface in which a field is crafted to abuse the missing output escaping. Because the flaw is in output encoding, the malicious content is carried into a context where the back-end does not neutralize special elements before use.

3. Execution at the vulnerability-class level. Depending on the destination context of the unescaped output, the attacker attempts:

   • path manipulation to read or write files outside the intended location (arbitrary file read/write), or
   • malformed values that disrupt SCGI/back-end processing to induce denial of service.

4. Post-exploitation impact. Successful arbitrary write could enable persistence, configuration tampering, or service disruption; arbitrary read could expose credentials, configuration, or sensitive data stored on the appliance; DoS could take management services or file-sharing offline. Given the NAS role, secondary impact to stored organizational data is significant.

Note: no in-the-wild exploitation, KEV listing, or public PoC is currently confirmed.

Impact Assessment

• Confidentiality (High): arbitrary file read exposes data held on or accessible to the appliance.
• Integrity (High): arbitrary file write permits modification of files, enabling tampering and potential persistence.
• Availability (High): denial-of-service conditions disrupt DSM services.
• Blast radius: any internet-exposed or internally reachable DSM instance below the fixed builds. NAS devices frequently store backups, credentials, and shared organizational data, magnifying downstream impact. No privileges or interaction required, so exposure alone is sufficient.
• EPSS: not yet scored by FIRST.org; no value is asserted.

Detection Guidance

Sigma Rule

title: Potential Synology DSM SCGI Output-Encoding Exploitation (CVE-2026-13684)
id: 9c7f1b2a-4e21-4c8d-9a11-2026cve13684
status: experimental
description: Detects anomalous requests targeting DSM SCGI endpoints consistent with output-encoding abuse (traversal-like or malformed input).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-13684
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: synology
detection:
  selection_scgi:
    cs-uri-query|contains:
      - 'scgi'
      - 'scgi-bin'
  selection_anomaly:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '%00'
      - '%%'
  condition: selection_scgi and selection_anomaly
falsepositives:
  - Legitimate administrative tooling issuing encoded paths
level: high

YARA Rule

rule CVE_2026_13684_SCGI_Traversal_Attempts
{
    meta:
        description = "Detects SCGI requests abusing output encoding for traversal/DoS (CVE-2026-13684)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-13684"
        date = "2026-01-01"
    strings:
        $scgi = "scgi" ascii nocase
        $t1 = "../" ascii
        $t2 = "..%2f" ascii nocase
        $t3 = "%00" ascii nocase
        $t4 = "../../" ascii
    condition:
        $scgi and any of ($t1, $t2, $t3, $t4)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-13684 Synology DSM SCGI Output-Encoding Exploitation Attempt"; flow:established,to_server; http.uri; content:"scgi"; nocase; http.uri; content:"../" or content:"..%2f"; nocase; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; reference:cve,2026-13684; sid:202613684; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where http.request.method == "GET" or http.request.method == "POST"
      and wildcard(http.request.uri, "*scgi*") ]
  [ network where wildcard(http.request.uri, "*../*") or wildcard(http.request.uri, "*..%2f*") ]

Splunk SPL Query

index=web OR index=proxy
| eval uri=coalesce(uri, url, cs_uri)
| where match(uri, "(?i)scgi") AND match(uri, "\.\./|\.\.%2f|%00")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri
| where count >= 3
| sort - count

Wazuh OSSEC Rule

<group name="synology,web,cve-2026-13684,">
  <rule id="100684" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>scgi</match>
    <regex>\.\./|\.\.%2f|%00</regex>
    <description>CVE-2026-13684: Synology DSM SCGI output-encoding exploitation attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict network access to DSM management interfaces; do not expose DSM/SCGI services directly to the internet. Place them behind VPN or a strictly scoped reverse proxy with authentication.
   • Apply firewall allowlists so only trusted management subnets reach DSM ports.
   • Segment NAS appliances from critical infrastructure to limit blast radius.
   • Monitor web/SCGI logs for traversal-like or malformed request patterns (see detection rules).

2. Patch / upgrade steps

   • Upgrade to the vendor-fixed builds: 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, or 7.4-90075.
   • Validate the vendor advisory in Synology's security center before scheduling maintenance; verify build hashes/signatures.
   • Reboot into the fixed build and confirm the running version via DSM update status.

3. Long-term hardening

   • Enforce least-exposure principles for all management planes.
   • Enable centralized logging and continuous detection for CWE-116-class anomalies.
   • Maintain a prompt patch cadence; subscribe to Synology security advisories.
   • Disable unused services/endpoints to reduce attack surface.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-13684
• CWE-116 — Improper Encoding or Escaping of Output: https://cwe.mitre.org/data/definitions/116.html
• Synology Product Security Advisory (vendor security center): https://www.synology.com/en-global/security
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV Catalog (CVE-2026-13684 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No confirmed threat actor campaigns, public PoC, or exploit-in-the-wild evidence is currently available for CVE-2026-13684.