CVE-2025-13167 Overview
CVE-2025-13167 is a stored cross-site scripting (XSS) vulnerability in the contact functionality of Synology Contacts. The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. Versions of Synology Contacts before 1.0.10-20659 are affected.
Remote authenticated users can exploit the issue to read or write specific files containing non-sensitive information through unspecified vectors. Successful exploitation requires user interaction and impacts confidentiality and integrity at a limited scope. Synology has documented the issue in Synology Security Advisory SA-25-13.
Critical Impact
Authenticated attackers can inject scripts that execute in victim browsers, enabling limited read and write of files containing non-sensitive information.
Affected Products
- Synology Contacts versions prior to 1.0.10-20659
- Synology DiskStation Manager (DSM) deployments running vulnerable Contacts packages
- Multi-user Synology NAS environments where Contacts is shared across accounts
Discovery Timeline
- 2026-05-27 - CVE-2025-13167 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2025-13167
Vulnerability Analysis
The vulnerability resides in the contact functionality of Synology Contacts. The application fails to properly neutralize user-controlled input before reflecting it into generated web pages. When a victim renders the affected view, the injected payload executes within the victim's authenticated browser session.
The issue is classified as Cross-site Scripting [CWE-79]. Because the scope is changed, the injected script can act beyond the vulnerable component's security boundary. The advisory states that successful exploitation enables remote authenticated users to read or write specific files containing non-sensitive information.
Exploitation requires both authentication and user interaction. An attacker first authenticates to the Synology system, stores a malicious contact entry containing scripted payloads, and then waits for another user to access the affected view. The browser executes the payload under the victim's session context.
Root Cause
The root cause is missing or insufficient output encoding when the Contacts application renders user-supplied contact field values into HTML responses. Input that should be treated as text data is interpreted as active markup or script by the browser. Synology's fix in version 1.0.10-20659 addresses the sanitization gap.
Attack Vector
The attack vector is Network. An authenticated user submits malicious input through contact fields exposed by the application. The payload is later rendered to other users of the same Synology system, triggering script execution and the documented limited file read or write actions through the victim's session.
No public proof-of-concept is available and no exploitation in the wild has been reported. The EPSS probability is 0.017%, reflecting low predicted exploitation activity.
Detection Methods for CVE-2025-13167
Indicators of Compromise
- Contact records containing HTML tags, <script> elements, javascript: URIs, or encoded equivalents such as <script>
- Unexpected outbound HTTP requests from browsers immediately after loading the Contacts application
- Modifications to Contacts-accessible files that do not correlate with legitimate user activity
Detection Strategies
- Review Synology Contacts data stores for contact fields containing script tags, event handlers (onerror=, onload=), or URL-encoded payloads
- Inspect web server access logs for POST requests to Contacts endpoints containing suspicious markup in form parameters
- Correlate authenticated user sessions with anomalous file read or write operations on the NAS
Monitoring Recommendations
- Enable DSM audit logging for the Contacts package and forward logs to a centralized SIEM
- Alert on browser console errors or content security policy violations originating from the Contacts web interface
- Monitor account activity patterns for users who create or modify contacts immediately followed by unusual file access by other accounts
How to Mitigate CVE-2025-13167
Immediate Actions Required
- Upgrade Synology Contacts to version 1.0.10-20659 or later through Package Center
- Audit existing contact entries for embedded HTML or script content and remove suspicious records
- Restrict Contacts package access to trusted users until the upgrade is applied
Patch Information
Synology has released Contacts version 1.0.10-20659 to address this vulnerability. Administrators should apply the update through DSM Package Center. Refer to the Synology Security Advisory SA-25-13 for the official fixed version and remediation guidance.
Workarounds
- Disable the Synology Contacts package on affected systems until the patch can be applied
- Limit access to the Contacts application to a minimal set of administrative accounts
- Enforce strict browser-side content filtering and avoid opening Contacts entries from untrusted users
# Verify installed Contacts package version on DSM
synopkg version Contacts
# Stop the Contacts package as a temporary workaround
sudo synopkg stop Contacts
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
