CVE-2022-27621: Synology USB Copy

Low severity, CVSS 3.8. EPSS: 0.8% chance of exploitation in the next 30 days.

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology USB Copy before 2.2.0-1086 allows remote authenticated users to read or write arbitrary files via unspecified vectors.

Affected products

• Synology USB Copy: before 2.2.0-1086 (fixed in 2.2.0-1086)

Published 2022-08-03. Last modified 2026-06-17.