CVE-2026-6205

Executive Summary

CVE-2026-6205 is an external control of file name or path vulnerability (CWE-73) in the Upload API of Synology DiskStation Manager (DSM). It allows a remote authenticated attacker to write arbitrary files and conduct denial-of-service attacks against affected NAS appliances. Synology DSM is widely deployed as internet- and LAN-exposed storage infrastructure across SMB, healthcare, and enterprise environments; any host running an affected DSM build prior to the fixed versions listed is in scope. With a CVSS of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), the flaw carries HIGH integrity and availability impact but no confidentiality impact, meaning the primary risk is data destruction, system corruption, or denial of service rather than exfiltration. No public PoC, exploit code, or Nuclei template currently exists, and the CVE is not in CISA KEV — the exploitation window is theoretical but plausible.

Technical Analysis

The vulnerability class is CWE-73: External Control of File Name or Path. In this class, an application accepts a filename or path component from a user-controllable input and uses it to perform a filesystem operation (open, write, move, delete, rename) without adequately constraining the resulting path. Because the path is attacker-influenced, an attacker can supply traversal sequences, absolute paths, or symlink-like targets that redirect the write operation to a location outside the intended upload directory.

For CVE-2026-6205 the affected surface is specifically the Upload API within Synology DiskStation Manager. The NVD description states that successful abuse permits:

1. Arbitrary file write — the attacker controls where the uploaded content lands on disk.
2. Denial-of-service — write operations can be directed at resource-sensitive or critical locations, or at large-volume targets that exhaust storage or destabilize services.

The CVSS vector encodes the precise risk profile:

• AV:N — exploitable over the network; the Upload API is reachable via HTTP(S) to an authenticated session.
• AC:L — no special conditions beyond a valid account are required.
• PR:L — a low-privileged authenticated user is sufficient; no administrative account is needed.
• UI:N — no victim interaction; the attack is fully attacker-driven.
• S:U — impact remains scoped to the vulnerable DSM host.
• C:N / I:H / A:H — no confidentiality loss, but complete loss of integrity and availability is possible.

The affected surface is the authentication-gated portion of the DSM Web API. Because the requirement is only a low-privileged account, the threat model includes any legitimate low-tier user, a compromised credential, or a shared/service account — a common situation on shared NAS appliances. The absence of a confidentiality impact suggests the primitive is write-oriented rather than read-oriented; the description does not disclose the exact path-construction code, parameter name, or storage backend, and no such specifics should be inferred.

Notably, Patch Confidence is 0/4 and no vendor advisory artifact was captured in the tracked sources. The fixed version strings exist only as they appear in the NVD description. Security teams should therefore treat all DSM builds below the listed fixed releases as potentially vulnerable until a vendor advisory is independently confirmed.

Exploitation Scenarios

No public PoC is available; the following chain is inferred strictly from the vulnerability class (CWE-73) and the NVD description. It does not assert specific endpoint paths, parameter names, or code symbols beyond the "Upload API" identified in the description.

1. Reconnaissance / target identification. The attacker identifies an internet- or LAN-reachable Synology DSM host (version banners, login portal, Web API responses) and confirms the DSM build falls below one of the fixed version thresholds. Valid low-privileged credentials must be obtained — via a legitimate account, shared credentials, credential stuffing, or another compromised service account.

2. Trigger of the flaw class. Using their authenticated session, the attacker invokes the DSM Upload API and supplies a crafted file name or path value. Because the application externally controls the file name/path without proper canonicalization or directory confinement, the attacker's input influences which filesystem location the uploaded file is written to. In CWE-73 terms, the write target is redirected away from the intended upload directory.

3. Payload / execution method (class level). The payload is a file-write primitive. The attacker writes attacker-chosen content to an attacker-chosen path. No code-execution primitive is claimed by the description — the impact is file-system write and service disruption, not remote code execution. Describing further execution specifics would require implementation details not present in the source data.

4. Post-exploitation impact. Direct consequences per the CVSS vector: Integrity (High) — arbitrary files can be written or overwritten, enabling tampering with configuration or data; Availability (High) — denial-of-service is achievable, for example by targeting locations whose modification or corruption destabilizes DSM services, or by consuming/overfilling storage. Confidentiality is not impacted per the vector (C:N).

Impact Assessment

• Business impact: Synology DSM appliances are frequently used as primary storage, backup targets, and file-sharing hubs. An attacker with even a low-privileged account can tamper with stored data (I:H) and render services unavailable (A:H). For ransomware-adjacent or insider threats, a silent arbitrary-write primitive against a backup/NAS target is high-value.
• Affected systems: All Synology DSM builds earlier than 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075.
• Blast radius: Scope is unchanged (S:U), so the blast radius is confined to the individual DSM host and the data/services it exposes. On multi-tenant or backup appliances, business impact can still be severe.
• Exploit prerequisites: Network reachability (AV:N), a valid low-privileged account (PR:L), no user interaction (UI:N), and low attack complexity (AC:L). This combination places the flaw squarely in the reachable, high-severity tier despite the absence of a public exploit.
• Current exploit status: No public PoC, no Nuclei template, no exploit code, not in CISA KEV, and no EPSS score yet published by FIRST.org. Detection must therefore rely on behavioral and log-based heuristics rather than known exploit signatures.

Detection Guidance

Detection is challenging because no PoC or signature exists. The rules below target the class of activity: authenticated Upload API calls, path-traversal indicators in file/path parameters, and writes to unexpected or sensitive destinations. Tune paths and API namespaces to your DSM deployment.

Sigma Rule

title: Synology DSM Upload API Path Traversal / Arbitrary File Write (CVE-2026-6205)
id: 8f3c1a2e-6205-4cve-9b1a-000000006205
status: experimental
description: Detects authenticated requests to the Synology DSM Upload API containing path traversal sequences, consistent with CWE-73 abuse in CVE-2026-6205.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-6205
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: synology
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|contains:
      - '/webapi/entry.cgi'
      - 'Upload'
      - 'upload'
  selection_traversal:
    cs-uri-query|contains:
      - '..%2f'
      - '../'
      - '..\\'
      - '%2e%2e%2f'
      - '%252e%252e%252f'
      - '%00'
  condition: selection_method and selection_uri and selection_traversal
fields:
  - c-ip
  - cs-username
  - cs-uri-query
falsepositives:
  - Legitimate uploads containing literal filename substrings that resemble traversal
level: high

YARA Rule

rule CVE_2026_6205_Synology_DSM_Upload_PathTraversal
{
    meta:
        author = "valtersit.com"
        description = "Detects path traversal payloads and arbitrary-write indicators targeting Synology DSM Upload API (CVE-2026-6205)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-6205"
        date = "2026-01-01"
        cve = "CVE-2026-6205"
        severity = "high"

    strings:
        $dsm1 = "webapi/entry.cgi" ascii nocase
        $api1 = "Upload" ascii nocase
        $tr1  = "../" ascii
        $tr2  = "..\\" ascii
        $tr3  = "..%2f" ascii nocase
        $tr4  = "%2e%2e%2f" ascii nocase
        $tr5  = "..%5c" ascii nocase
        $nul  = "%00" ascii
        $syno = "Synology" ascii nocase

    condition:
        (uint16(0) == 0x0A0D or true) and
        $api1 and
        (any of ($tr*)) and
        (any of ($dsm1, $syno, $nul))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-6205 Synology DSM Upload API Path Traversal Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"entry.cgi"; nocase; http.uri; content:"Upload"; nocase; http.uri; content:".."; fast_pattern; pcre:"/(\.\.(\\|\/|%2f|%5c)|%2e%2e(%2f|%5c))/iU"; classtype:attempted-admin; reference:cve,2026-6205; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-6205; sid:20266205; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, created_by valtersit.com;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ network where http.request.method == "POST" and
      http.request.uri : ("*entry.cgi*" or "*Upload*" or "*upload*") and
      user.name : * ]
  [ network where http.request.uri : ("*../*" or "*..%2f*" or "*%2e%2e%2f*" or "*..%5c*") and
      user.name : * ]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=nginx:plus:access
| eval uri_lower=lower(uri)
| where match(uri_lower,"(entry\.cgi|upload)") AND match(uri_lower,"(\.\.(/|\\|%2f|%5c)|%2e%2e(%2f|%5c)|%00)")
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as status_codes values(method) as methods by src_ip user uri
| where count > 0
| sort - count
| table src_ip user uri count first_seen last_seen status_codes methods

Wazuh OSSEC Rule

<group name="synology,dsm,web,cve-2026-6205,">
  <rule id="100205" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.\.(%2f|/|\\|%5c)</field>
    <description>CVE-2026-6205: Synology DSM Upload API path traversal / arbitrary file write attempt detected</description>
    <options>no_full_log</options>
  </rule>

  <rule id="100206" level="12">
    <if_sid>31100,31101,31103,31108</if_sid>
    <match>entry.cgi|webapi|upload</match>
    <regex>\.\.(%2f|/|\\|%5c)|%2e%2e|%00</regex>
    <description>CVE-2026-6205: Suspicious authenticated DSM Upload API request with traversal sequence</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (in the absence of a verified patch artifact):

   • Restrict network exposure of DSM: remove the management/Web API interface from the public internet; place it behind a VPN, zero-trust proxy, or firewall allowlist. This directly counters AV:N.
   • Enforce least privilege: audit all DSM accounts, remove stale or shared low-privileged accounts (the flaw requires only PR:L), and disable unused accounts.
   • Enable MFA and strict account lockout to reduce the likelihood of obtaining an authenticated session.
   • Apply the rule set in the Detection Guidance section and alert on traversal patterns and unexpected writes.
   • Verify that the Upload API is disabled or unused for accounts that do not require it, if DSM permissions allow.
   • Ensure backups are immutable/offline; an arbitrary-write primitive against a backup target is high-impact.

2. Patch / upgrade steps:

   • Per the NVD description, fixed builds are DSM 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075.
   • Upgrade each DSM host to the appropriate fixed build for its branch: Control Panel → Update & Restore → DSM Update, or offline update via the Synology Download Center.
   • Because Patch Confidence is 0/4 and no vendor advisory artifact was tracked, independently confirm the fix against Synology's official security advisory and release notes before closing the finding. Do not assume patched status without vendor confirmation.

3. Long-term hardening:

   • Maintain an inventory of DSM builds and subscribe to Synology security advisories.
   • Enforce network segmentation so NAS management planes are not directly reachable from untrusted networks.
   • Implement file-integrity monitoring on NAS data volumes to detect arbitrary-write activity.
   • Adopt centralized, immutable log retention to support post-incident forensics.

References

• NVD — CVE-2026-6205: https://nvd.nist.gov/vuln/detail/CVE-2026-6205
• MITRE CWE-73 — External Control of File Name or Path: https://cwe.mitre.org/data/definitions/73.html
• Synology Security Advisories (vendor advisory portal — confirm matching DSM advisory for this CVE): https://www.synology.com/en-global/security/advisory
• Synology Download Center (fixed DSM builds): https://www.synology.com/en-global/support/download
• CISA Known Exploited Vulnerabilities Catalog (current status: NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild / threat actor note: No public PoC, exploit code, or Nuclei template exists for CVE-2026-6205 at the time of writing, and the CVE is not in CISA KEV. There is no known threat-actor campaign associated with this identifier in the provided data. Any future KEV addition or public exploit should be treated as a material escalation given the AV:N / PR:L profile and the high-value nature of NAS targets.