CVE-2025-29843: Synology Router Manager Path Traversal

CVE-2025-29843 Overview

CVE-2025-29843 is a path traversal vulnerability [CWE-22] in the FileStation thumb.cgi component of Synology Router Manager (SRM). The flaw allows remote authenticated users to read and write image files outside of intended directory boundaries. Synology disclosed the issue in advisory Synology_SA_25_04 and published the CVE to the National Vulnerability Database (NVD) on December 4, 2025.

The vulnerability affects the thumb.cgi handler responsible for generating image thumbnails within FileStation. Because the attack requires valid authentication and grants limited read/write access constrained to image files, the impact is bounded but still meaningful for multi-user SRM deployments.

Critical Impact
Authenticated attackers can read and write image files at arbitrary filesystem locations accessible to the FileStation service, potentially exposing or tampering with user content on Synology routers running vulnerable SRM versions.

Affected Products

Synology Router Manager (SRM) 1.3.1-9346 (base release)
Synology Router Manager 1.3.1-9346 Update 1 through Update 12
Synology routers running the affected SRM firmware releases

Discovery Timeline

2025-12-04 - CVE-2025-29843 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29843

Vulnerability Analysis

The vulnerability resides in the FileStation thumb.cgi endpoint, which processes requests to render image thumbnails. The handler accepts a file path parameter used to locate the source image and, in vulnerable versions, does not sufficiently validate or canonicalize the supplied path.

An authenticated remote user can submit crafted path values that traverse outside of the intended FileStation share directories. The endpoint operates on files under the FileStation service context, so its file access is bounded by that context and by image-file semantics.

Because thumb.cgi handles both reading source images and writing generated thumbnail artifacts, the flaw impacts both confidentiality and integrity of image files. It does not directly enable arbitrary code execution or affect service availability.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. Path components such as ../ or absolute paths supplied to thumb.cgi are not adequately normalized before the CGI opens or writes the target file. This allows the resolved path to escape the FileStation share root.

Attack Vector

Exploitation is network-based and requires an authenticated FileStation session on an affected Synology router. The attacker issues an HTTP request to the FileStation thumb.cgi endpoint with a manipulated path parameter referencing a location outside the permitted share.

On a successful request, the CGI returns the contents of the referenced image file or writes generated thumbnail data to the attacker-controlled path. No user interaction is required beyond the attacker's authenticated session. Refer to the Synology Security Advisory SA-25-04 for vendor-confirmed exploitation preconditions.

Detection Methods for CVE-2025-29843

Indicators of Compromise

HTTP requests to FileStation thumb.cgi containing path traversal sequences such as ..%2F, ../, or absolute filesystem paths in query parameters
Unexpected image files appearing in system or non-share directories on SRM devices
Access log entries showing authenticated FileStation sessions reading files outside the user's assigned shares

Detection Strategies

Inspect SRM web access logs for thumb.cgi requests with encoded traversal patterns or unusually long path parameters
Correlate authenticated FileStation session activity with file read/write events targeting unexpected directories
Baseline normal thumb.cgi request patterns and alert on deviations in path parameter structure or request volume from a single account

Monitoring Recommendations

Forward SRM system and web access logs to a centralized logging platform for retention and query
Monitor for authenticated user accounts issuing FileStation requests from anomalous source addresses or geographies
Review FileStation permission assignments periodically and alert on privilege changes or new user accounts created on the router

How to Mitigate CVE-2025-29843

Immediate Actions Required

Update Synology Router Manager to the fixed release identified in Synology Security Advisory SA-25-04
Audit all FileStation user accounts and remove unused or overly privileged credentials
Restrict FileStation access to trusted networks using SRM firewall rules until the patch is applied

Patch Information

Synology has published fix information in advisory Synology_SA_25_04. Administrators should consult the advisory for the specific SRM 1.3.1 update level that remediates CVE-2025-29843 and apply the update through the SRM Package Center or the router's update interface.

Workarounds

Disable FileStation on the router if it is not required for business operations
Block external access to the SRM web interface and expose it only over VPN or trusted LAN segments
Enforce strong authentication, including two-factor authentication, for all accounts with FileStation access

bash

# Example: restrict FileStation web access to a trusted subnet via SRM firewall
# Navigate: Network Center > Security > Firewall
# Create rule:
#   Source IP:      192.0.2.0/24        # trusted management subnet
#   Destination:    SRM device
#   Ports:          5000, 5001          # DSM/SRM web ports
#   Action:         Allow
# Follow with a default-deny rule for the same ports from any other source.