CVE-2019-11826: Synology Moments

High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days.

Relative path traversal vulnerability in SYNO.PhotoTeam.Upload.Item in Synology Moments before 1.3.0-0691 allows remote authenticated users to upload arbitrary files via the name parameter.

Affected products

• Synology Moments: before 1.3.0-0691 (fixed in 1.3.0-0691)

Published 2019-06-30. Last modified 2026-06-17.