CVE-2023-0142: Synology Diskstation Manager

High severity, CVSS 8.1. EPSS: 1% chance of exploitation in the next 30 days.

Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7 and 7.1-42661 allows remote authenticated users with administrator privileges to read or write arbitrary files via unspecified vectors.

Affected products

• Synology Diskstation Manager: from 6.2, before 7.1-42661 (fixed in 7.1-42661)
• Synology Diskstation Manager Unified Controller: version 3.1 only
• Synology Router Manager: from 1.2, before 1.3.1-9346 (fixed in 1.3.1-9346); version 1.3.1-9346 only

Published 2023-06-13. Last modified 2026-06-17.