Threat Intelligence Report — CVE-2026-40535

Executive Summary

CVE-2026-40535 is a path traversal vulnerability (CWE-22) in the Desktop API component of Synology DiskStation Manager (DSM). The flaw permits a remote, unauthenticated attacker to write a limited set of files and trigger a limited denial-of-service condition. All DSM installations running versions prior to 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2 are potentially affected; the flaw carries a CVSS v3.1 base score of 6.5 (Medium) with Integrity and Availability impacts rated Low and no Confidentiality impact.

Technical Analysis

The vulnerability is classified as an improper limitation of a pathname to a restricted directory, commonly known as path traversal or directory traversal (CWE-22). The affected component is the Desktop API of Synology DSM. Per the NVD description, the vulnerability "allows remote attackers to write limited files and conduct limited denial-of-service attacks."

Path traversal vulnerabilities arise when an application constructs a filesystem path from externally supplied input without adequately neutralizing directory-traversal sequences (for example, ../ sequences or their encoded/obfuscated equivalents). When such input reaches a file-handling operation, an attacker can redirect reads or writes outside the intended directory scope. In this instance, the NVD description indicates the impact is bounded: attackers can write limited files and cause a limited DoS — the qualifier "limited" and the CVSS subscores (Integrity: Low, Availability: Low, Confidentiality: None) are consistent with a constrained write primitive rather than unrestricted arbitrary file write.

Because no CNA Title, no CPE package data, and no affected-version list were supplied beyond the version boundaries in the description, the report cannot assert specific endpoint names, request parameters, function names, or file paths within the Desktop API. The attack surface is the Desktop API exposed by DSM, which is reachable over the network (AV:N) with no privileges (PR:N) and no user interaction (UI:N), consistent with a remotely reachable pre- or un-authenticated surface. Network reachability of the DSM management interface (typically HTTPS on the appliance's web ports) determines exposure.

The attack complexity is Low (AC:L) in the CVSS vector, implying the traversal can be triggered without specialized conditions (no race window, no unusual configuration) once the vulnerable code path is reached. Scope is Unchanged (S:U), indicating exploitation does not cross a security authority boundary beyond the vulnerable component's own context — the write and DoS effects remain within the DSM host's own file/process space as characterized by the vendor.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is known (POC_STATUS: None). The following chain is therefore described at the vulnerability-class level, drawing strictly on the NVD description ("path traversal in Desktop API ... write limited files and conduct limited denial-of-service attacks"). No specific endpoints, parameters, or file paths are asserted because none are provided.

1. Reconnaissance / target identification — An attacker scans for internet- or intranet-exposed Synology DSM instances (DSM management/web interface and Desktop API). Shodan dorks such as product:"Synology DiskStation" and http.title:"DSM" identify candidate hosts. The attacker confirms reachability to the Desktop API surface.

2. Triggering the flaw — The attacker sends a crafted request to the Desktop API containing path-traversal sequences in input that the API uses to build a filesystem path. Because the code fails to properly restrict the pathname to its intended directory (CWE-22), the traversal redirects the file operation outside the intended scope. Per the description, no authentication is required (PR:N) and no user interaction is needed (UI:N).

3. Payload / execution (class-level) — The write primitive is limited: the attacker can cause the application to write a constrained set of files to locations reachable via the traversal. This is a write/tampering primitive, not (per the description) an arbitrary-code-execution primitive. Separately, the same manipulation enables a limited denial-of-service condition affecting the service.

4. Post-exploitation impact — Consequences are bounded per CVSS: Integrity Low (limited file writes/partial tampering) and Availability Low (limited DoS), with Confidentiality None (no data disclosure indicated). There is no evidence in the provided data of privilege escalation, credential theft, or persistent remote code execution.

If the attacker obtains a reliable traversal primitive, the limited write capability could potentially be chained with other DSM weaknesses, but no such chain is described or confirmed here and should not be assumed.

Impact Assessment

• Affected systems: Synology DSM deployments running versions below the fixed releases (7.2.1-69057-10, 7.2.2-72806-7, 7.3.2-86009-2). Synology NAS devices are frequently internet-exposed, widening the practical blast radius.
• CVSS v3.1 subscores: AV:N (network exploitable), AC:L (low complexity), PR:N (no privileges), UI:N (no interaction), S:U (unchanged scope), C:N (no confidentiality loss), I:L (low integrity loss), A:L (low availability loss) — base 6.5 (Medium).
• Business impact: Primarily integrity and availability risk: unauthorized/limited file modification within the DSM context and service disruption. The absence of Confidentiality impact reduces data-exfiltration risk, and the "limited" qualifiers cap severity relative to full arbitrary-file-write flaws.
• EPSS: Not yet scored by FIRST.org as of this report. Readers should check the FIRST EPSS portal for updates; no value is asserted here.
• CISA KEV: Not listed.

Detection Guidance

Detection should focus on path-traversal patterns in requests to the DSM Desktop API and on anomalous file-write/service-disruption behavior on the appliance.

Sigma Rule

title: Path Traversal Attempt Against Synology DSM Desktop API (CVE-2026-40535)
id: 8a1f3c2e-5d4b-4e9a-9c7f-2b6e1d0a4f35
status: experimental
description: Detects HTTP requests to the Synology DSM Desktop API containing directory traversal sequences indicative of CVE-2026-40535 exploitation attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-40535
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: synology
detection:
  selection_path:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%5c'
      - '%2e%2e%2f'
      - '%2e%2e/'
      - '..%252f'
  selection_target:
    cs-uri-stem|contains:
      - '/webapi/'
      - '/desktop'
  condition: selection_path and selection_target
falsepositives:
  - Legitimate applications sending encoded path parameters (rare)
level: high
tags:
  - attack.t1190
  - cve.2026.40535
  - cwe.22

YARA Rule

rule CVE_2026_40535_Synology_DSM_PathTraversal
{
    meta:
        description = "Detects path traversal payloads targeting Synology DSM Desktop API (CVE-2026-40535)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-40535"
        cve = "CVE-2026-40535"
        date = "2026-01-01"

    strings:
        $trav1 = "../" ascii wide nocase
        $trav2 = "..\\" ascii wide nocase
        $enc1  = "..%2f" ascii nocase
        $enc2  = "%2e%2e%2f" ascii nocase
        $enc3  = "..%5c" ascii nocase
        $dbl   = "..%252f" ascii nocase
        $api   = "/webapi/" ascii nocase
        $dsm   = "Synology" ascii wide nocase

    condition:
        (any of ($trav*) or any of ($enc*) or $dbl) and
        ($api or $dsm)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-40535 Synology DSM Desktop API Path Traversal Attempt"; flow:established,to_server; http.uri; content:"/webapi/"; http.uri; content:"../"; nocase; http.uri; content:"%2e%2e"; nocase; http.uri; content:"%2f"; nocase; classtype:attempted-admin; reference:cve,2026-40535; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-40535; sid:202640535; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method in ("GET","POST") and
     http.request.uri : ("/webapi/" or "/desktop") and
     http.request.uri : ("../" or "..%2f" or "..%5c" or "%2e%2e")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=pan:traffic OR sourcetype=suricata
| eval uri=coalesce(uri, cs_uri, url, http_url)
| where match(uri, "(?i)(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/|\.\.%2f|\.\.%5c|\.\.%252f)")
| where match(uri, "(?i)(/webapi/|/desktop)")
| stats count min(_time) as first_seen max(_time) as last_seen values(src) as sources by uri, src_ip
| sort - count

Wazuh OSSEC Rule

<group name="web,synology,cve-2026-40535,">
  <rule id="100535" level="12">
    <if_sid>31100</if_sid>
    <decoded_as>web-accesslog</decoded_as>
    <regex_type>pcre2</regex_type>
    <url type="pcre2">(?i)(?:\.\./|\.\.\\|%2e%2e%2f|\.\.%2f|\.\.%5c)</url>
    <url type="pcre2">(?i)(?:/webapi/|/desktop)</url>
    <description>CVE-2026-40535: Possible Synology DSM Desktop API path traversal exploitation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_40535,web_attack,</group>
  </rule>
</group>

Note: The Sigma/YARA/Suricata/Elastic/Splunk/Wazuh rules above target the vulnerability class (path traversal in the DSM Desktop API) because no exact endpoint or parameter is disclosed in the NVD data. They are tuning candidates, not confirmed signatures.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor description references fixed version strings, but no patch artifacts were verified in tracked sources; treat as unverified.

1. Immediate mitigations

   • Restrict network exposure of the DSM management interface and Desktop API to trusted networks/VPN. Do not expose DSM directly to the internet.
   • Enforce strong authentication and least-privilege access to the DSM web/management surface.
   • Monitor web logs for traversal patterns (see Detection Guidance) and alert on anomalous file writes or service restarts.

2. Patch / upgrade steps

   • Upgrade to DSM 7.2.1-69057-10, 7.2.2-72806-7, or 7.3.2-86009-2 (or later) as referenced in the advisory.
   • Verify the installed build via DSM Control Panel → Info Center, and confirm the build number matches or exceeds the fixed release.
   • Re-validate exposure after upgrade and re-enable any temporarily restricted services.

3. Long-term hardening

   • Apply a vulnerability management cadence for NAS/management appliances; subscribe to Synology security advisories.
   • Segment NAS management planes from user/data networks; enforce MFA.
   • Maintain centralized logging (web, auth, system) and periodic review of path-traversal detections.

References

1. NVD — CVE-2026-40535: https://nvd.nist.gov/vuln/detail/CVE-2026-40535
2. Synology Security Advisory (vendor) — refer to the Synology Product Security Advisory portal for the corresponding SA entry covering DSM Desktop API path traversal.
3. FIRST EPSS — https://www.first.org/epss/ (CVE-2026-40535 unscored at time of writing)
4. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: https://cwe.mitre.org/data/definitions/22.html

Threat actor / in-the-wild note: No CISA KEV listing, no public PoC, and no exploit-in-the-wild evidence were provided. No attribution to any threat actor is asserted.