CVE-2026-13683: Synology DSM EventScheduler SQL Injection

CVE-2026-13683 Overview

CVE-2026-13683 is a SQL injection vulnerability in the EventScheduler API of Synology DiskStation Manager (DSM). The flaw stems from improper neutralization of special elements in SQL commands [CWE-89]. Remote authenticated users with administrator privileges can exploit the issue to obtain non-sensitive information from the underlying database. Synology addressed the issue in DSM 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075.

Critical Impact
Authenticated administrators can inject SQL through the EventScheduler API to read non-sensitive database content over the network.

Affected Products

Synology DiskStation Manager (DSM) prior to 7.2.1-69057-12
Synology DiskStation Manager (DSM) 7.2.2 prior to 7.2.2-72806-9
Synology DiskStation Manager (DSM) 7.3.2 prior to 7.3.2-86009-4 and 7.4 prior to 7.4-90075

Discovery Timeline

2026-09-18 - CVE CVE-2026-13683 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-13683

Vulnerability Analysis

The vulnerability resides in the EventScheduler API component of Synology DSM. The API accepts user-controllable input that is concatenated into a SQL query without adequate sanitization or parameterization. An authenticated administrator can craft a request containing SQL metacharacters, altering the intended query logic. Successful exploitation yields non-sensitive information from the database, without impacting integrity or availability.

Exploitation requires network reachability to the DSM web interface and valid administrator credentials. The prerequisite of administrator privileges limits practical exposure to insider misuse, compromised admin accounts, or post-exploitation scenarios where an attacker has already escalated access.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command within the EventScheduler API handler. Input intended for query construction is not bound as parameters or escaped, allowing attacker-controlled tokens to modify the SQL statement executed by the database backend.

Attack Vector

The attack vector is network-based against the DSM management API. An authenticated administrator sends a specially crafted request to the vulnerable EventScheduler endpoint. The payload injects SQL fragments into a parameter that is concatenated into a database query. See the Synology Security Advisory SA-26-13 for vendor guidance and version-specific fix details.

Detection Methods for CVE-2026-13683

Indicators of Compromise

Unexpected requests to the DSM EventScheduler API from administrator sessions containing SQL syntax such as UNION, SELECT, single quotes, or comment markers (--, /*).
Database error responses returned to authenticated management sessions during scheduled task configuration workflows.
Administrator API activity originating from unusual source IP addresses or outside expected maintenance windows.

Detection Strategies

Review DSM web server and application logs for EventScheduler API calls containing SQL metacharacters in query parameters or request bodies.
Correlate administrator authentication events with subsequent scheduler API activity to identify anomalous automation or scripted access.
Baseline normal EventScheduler usage patterns and alert on deviations in payload structure, request volume, or parameter length.

Monitoring Recommendations

Forward DSM audit logs and web access logs to a centralized log platform for long-term retention and query.
Monitor administrator account logins, particularly from new geographies or unusual client fingerprints.
Enable alerting on DSM database error signatures and failed query patterns that may indicate injection probing.

How to Mitigate CVE-2026-13683

Immediate Actions Required

Upgrade DSM to a fixed release: 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, or 7.4-90075, matching your current release branch.
Audit administrator accounts on all Synology appliances and remove or disable unused privileged users.
Rotate credentials for any administrator account suspected of compromise and enforce multi-factor authentication.

Patch Information

Synology released fixed versions in the DSM 7.2.1, 7.2.2, 7.3.2, and 7.4 branches. Refer to the Synology Security Advisory SA-26-13 for the complete list of fixed builds and upgrade instructions. Apply patches through DSM Control Panel or Synology's download center.

Workarounds

Restrict DSM management interface exposure to trusted management networks using firewall rules or VPN gating.
Limit administrator privileges to the smallest set of accounts and enforce strong password and MFA policies.
Enable DSM's IP auto-block and account protection features to slow credential-based attacks against administrator accounts.

bash

# Configuration example
# Restrict DSM management to a trusted admin subnet via firewall (example only)
# Adjust interface, subnet, and DSM port to match your environment
iptables -A INPUT -p tcp --dport 5001 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5001 -j DROP