CVE-2022-27620: Synology SSO Server

Medium severity, CVSS 4.9. EPSS: 1.5% chance of exploitation in the next 30 days.

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology SSO Server before 2.2.3-0331 allows remote authenticated users to read arbitrary files via unspecified vectors.

Affected products

• Synology SSO Server: before 2.2.3-0331 (fixed in 2.2.3-0331)

Published 2022-08-03. Last modified 2026-06-17.