CVE-2025-29845
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-04

Last updated on: 2025-12-05

Assigner: Synology Inc.

Description
A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-04
Last Modified
2025-12-05
Generated
2026-06-16
AI Q&A
2025-12-04
EPSS Evaluated
2026-06-15
NVD
CVE-2025-29845
EUVD
EUVD-2025-201173
Affected Vendors & Products
Showing 14 associated CPEs
Vendor Product Version / Range
synology router_manager From 1.3 (inc) to 1.3.1-9346 (exc)
synology router_manager 1.3.1-9346
synology router_manager 1.3.1-9346
synology router_manager 1.3.1-9346
synology router_manager 1.3.1-9346
synology router_manager 1.3.1-9346
synology router_manager 1.3.1-9346
synology router_manager 1.3.1-9346
synology router_manager 1.3.1-9346
synology router_manager 1.3.1-9346
synology router_manager 1.3.1-9346
synology router_manager 1.3.1-9346
synology router_manager 1.3.1-9346
synology router_manager 1.3.1-9346
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the VideoPlayer2 subtitle CGI, which allows remote authenticated users to read .srt subtitle files that they should not normally have access to.

Impact Analysis

An attacker with valid authentication could read subtitle files (.srt) remotely, potentially exposing sensitive or private information contained within those files. The impact is limited to confidentiality as it does not affect integrity or availability.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade Synology SRM to version 1.3.1-9346-13 or later, which resolves this and related path traversal issues in VideoPlayer2 and FileStation components. No other mitigation is provided. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-29845. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart