CVE-2026-40530: synology diskstation manager (dsm) CRLF Injection

Vulnerability summary

CVE-2026-40530 is a high (CVSS 8.0) CRLF Injection vulnerability in synology diskstation manager (dsm). EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 41.3% of scored vulnerabilities.

Timeline

1. 18-09-2026
   PublishedVulnerability first disclosed.
2. 18-09-2026
   Last modifiedVulnerability information updated.

Description

An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks after the system is rebooted.

• CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.