CVE-2026-9548

Awaiting Analysis Awaiting Analysis - Queue

Cross-Site Scripting in Synology Chat Server

Publication date: 2026-08-28

Last updated on: 2026-09-01

Assigner: Synology Inc.

Description

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks in DSM.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-01

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-9548

EUVD

EUVD-2026-67463

Affected Vendors & Products

Vendor	Product	Version / Range
synology	chat_server	2.4.5-22148

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Cross-site Scripting (XSS) vulnerability in Synology Chat Server before version 2.4.5-22148. It occurs due to improper neutralization of input during web page generation in the extract domain functionality. A remote authenticated user can exploit this via UI interaction to read or write restricted files and perform limited denial-of-service attacks.

Detection Guidance

This vulnerability is specific to Synology Chat Server before version 2.4.5-22148 and involves a cross-site scripting flaw in the extract domain functionality. Detection primarily involves checking the installed version of Synology Chat Server. Use the command 'synoservice --status | grep chat' to verify the running version. If the version is below 2.4.5-22148, the system is vulnerable.

Impact Analysis

An attacker could exploit this to access sensitive files, modify system files, or disrupt services. Since it requires authentication, the risk is limited to users with valid accounts but could still lead to data breaches or service outages.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Upgrade Synology Chat Server to version 2.4.5-22148 or later to address the XSS vulnerability and prevent potential file access or denial-of-service attacks.

Hi! I’m here to help you understand CVE-2026-9548. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70