Synology Beedrive vulnerabilities
6 CVEs affecting Synology Beedrive, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-11399, published 2026-05-27.
More from Synology.
Highest priority
Known exploited (CISA KEV) first, then by EPSS exploit probability.
- CVE-2025-54159, published 2025-12-04. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attackers to delete arbitrary files via unspecified vectors.
- CVE-2025-54160, published 2025-12-04. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary…
- CVE-2025-54158, published 2025-12-04. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.
- CVE-2023-52945, published 2026-05-27. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to execute arbitrary code via unspecified vectors.
- CVE-2024-11399, published 2026-05-27. Medium severity, CVSS 6.8. EPSS: 0.1% chance of exploitation in the next 30 days. Files or directories accessible to external parties vulnerability in redis-server component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to conduct denial-of-service attacks…
- CVE-2025-8074, published 2025-12-04. Medium severity, CVSS 5.6. EPSS: 0.1% chance of exploitation in the next 30 days. Origin validation error vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.3-13973 allows local users to write arbitrary files with non-sensitive information via unspecified…