CVE-2026-13666: Synology DSM CRLF Injection Vulnerability

CVE-2026-13666 Overview

CVE-2026-13666 is a Carriage Return Line Feed (CRLF) injection vulnerability [CWE-93] in the Sharing API of Synology DiskStation Manager (DSM). The flaw stems from improper neutralization of CRLF sequences in shared URLs. Remote authenticated users can craft malicious sharing links that write limited files when a victim clicks the URL. Exploitation requires user interaction and low-privileged authenticated access to the DSM instance. Synology addressed the issue across multiple DSM branches with patched builds.

Critical Impact
Authenticated attackers can write limited files on victim systems through crafted sharing URLs, enabling downstream integrity attacks against DSM users.

Affected Products

Synology DiskStation Manager (DSM) 7.2.1 before 7.2.1-69057-12
Synology DiskStation Manager (DSM) 7.2.2 before 7.2.2-72806-9
Synology DiskStation Manager (DSM) 7.3.2 before 7.3.2-86009-4 and 7.4 before 7.4-90075

Discovery Timeline

2026-09-18 - CVE CVE-2026-13666 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-13666

Vulnerability Analysis

The vulnerability resides in the Sharing API component of Synology DSM. The API fails to neutralize CRLF sequences (\r\n) embedded in user-controlled inputs used to construct sharing URLs. When a victim clicks a manipulated sharing link, the injected control characters alter the intended request or response flow, resulting in constrained file write operations on the target.

The attack chain requires an authenticated attacker with low privileges on the DSM instance and a victim who follows the crafted sharing URL. The scope of write is bounded by the Sharing API's permissions, limiting the vulnerability to partial integrity impact without confidentiality or availability consequences.

Root Cause

The root cause is missing sanitization of CRLF characters in parameters processed by the Sharing API [CWE-93]. Because line terminators are not stripped or encoded prior to inclusion in outbound URL and response contexts, an attacker can split headers or inject additional protocol elements that the client interprets as legitimate instructions.

Attack Vector

Exploitation follows a network-based vector requiring authentication and user interaction. The attacker authenticates to a DSM instance, generates a sharing URL containing crafted CRLF payloads, and distributes the URL to a target user. When the victim opens the link, the DSM client processes the injected sequences and performs the resulting limited file write operation.

No public proof-of-concept exploit or verified code is available for CVE-2026-13666. Refer to the Synology Security Advisory SA-26-13 for vendor technical details.

Detection Methods for CVE-2026-13666

Indicators of Compromise

Sharing URLs containing encoded CRLF sequences such as %0d%0a, %0D%0A, or literal \r\n in query parameters
Unexpected file creation or modification events under DSM shared directories following user click events on sharing links
Sharing API request logs showing anomalous header structures or duplicated response headers

Detection Strategies

Inspect DSM web access logs for Sharing API endpoints containing URL-encoded line terminators in parameters
Correlate authenticated Sharing API usage with subsequent filesystem write events on recipient accounts to identify anomalous chains
Alert on outbound sharing links generated by low-privilege accounts that contain non-printable or control character sequences

Monitoring Recommendations

Enable DSM audit logging for the Sharing API and forward events to a centralized log platform for retention and correlation
Monitor for repeated failed authentication attempts followed by sharing URL generation from the same account
Track file write anomalies in shared folders and correlate with recent sharing link activity

How to Mitigate CVE-2026-13666

Immediate Actions Required

Upgrade Synology DSM to a fixed release: 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, or 7.4-90075 or later
Audit DSM user accounts and remove or restrict low-privilege accounts that do not require Sharing API access
Review recent sharing link activity for anomalous URL parameters and revoke suspicious links

Patch Information

Synology released fixed builds addressing CVE-2026-13666 in DSM 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. Administrators should apply the appropriate update through the DSM Control Panel or Package Center. Full remediation guidance is available in the Synology Security Advisory SA-26-13.

Workarounds

Restrict Sharing API access to trusted user groups until patching is complete
Disable public sharing link generation for accounts that do not require the feature
Instruct users to avoid clicking sharing URLs received from untrusted or unverified DSM accounts

bash

# Verify installed DSM version before and after patching
synogetkeyvalue /etc.defaults/VERSION productversion
synogetkeyvalue /etc.defaults/VERSION buildnumber