CVE-2017-15894: Synology Diskstation Manager

Medium severity, CVSS 6.5. EPSS: 2% chance of exploitation in the next 30 days.

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology DiskStation Manager (DSM) 6.0.x before 6.0.3-8754-3 and before 5.2-5967-6 allows remote authenticated users to write arbitrary files via the dest_folder_path parameter.

Affected products

• Synology Diskstation Manager: from 5.2, before 5.2-5967-6 (fixed in 5.2-5967-6); from 6.0, before 6.0.3-8754-3 (fixed in 6.0.3-8754-3)

Published 2017-12-08. Last modified 2026-06-17.