CVE-2026-40541

Awaiting Analysis Awaiting Analysis - Queue

Cross-Site Scripting in Synology Chat Server

Publication date: 2026-08-28

Last updated on: 2026-09-01

Assigner: Synology Inc.

Description

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-01

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-40541

EUVD

EUVD-2026-67461

Affected Vendors & Products

Vendor	Product	Version / Range
synology	chat_server	to 2.4.5-22148 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a cross-site scripting (XSS) vulnerability in Synology Chat Server before version 2.4.5-22148. It occurs due to improper input neutralization during web page generation in the extract domain functionality. A remote authenticated user can exploit this via UI interaction to read or write arbitrary files and perform denial-of-service attacks.

Detection Guidance

To detect this vulnerability, check the installed version of Synology Chat Server. If it is before 2.4.5-22148, the system is vulnerable. Use the Synology Package Center or SSH commands like 'synopkg list' to verify the version.

Impact Analysis

An attacker could exploit this to access sensitive files, modify system files, or disrupt services. Since it requires authentication, the risk is higher for users with valid accounts. The high CVSS score (9.0) reflects significant potential for confidentiality, integrity, and availability breaches.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy). Organizations may face compliance penalties if exploited. Immediate patching is recommended to maintain regulatory adherence.

Mitigation Strategies

Immediately upgrade Synology Chat Server to version 2.4.5-22148 or later. This can be done via the Synology Package Center or using the command 'synopkg upgrade Chat' if available.

Hi! I’m here to help you understand CVE-2026-40541. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70