CVE-2026-4036 — An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files

Back Back to CVE browser

MEDIUM

An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files

Published Sep 18, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.45%

Description

An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files.

Affected products

Vendor Synology Product DiskStation Manager (DSM) Default
affected
- Version
  7.2.1
  Status
  affected
  Constraints
  <7.2.1-69057-10
- Version
  7.2.2
  Status
  affected
  Constraints
  <7.2.2-72806-7
- Version
  7.3
  Status
  affected
  Constraints
  <7.3.2-86009-2