Synology Chat Server fixes 3 vulnerabilities

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Synology Chat Server fixes 3 vulnerabilities

Synology fixes 3 vulnerabilities in Synology Chat Server with version 2.4.5-22148 [1].

Synology Chat Server - arbitrary file read/write, DoS (CVE-2026-40541)

CVSS 9.0 (Critical)

An authenticated remote attacker can read or write arbitrary files and perform a DoS attack through an XSS vulnerability [1].

The vulnerability is present in product:

Synology Chat Server (DSM); =7.3; =7.2.2; =7.2.1

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

More information:

CVE-2026-40541 at cve.org, NVD
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 26. 5. 2026.

Synology Chat Server - arbitrary file read/write, DoS (CVE-2026-9548)

CVSS 6.5 (Medium)

An authenticated remote attacker can read or write selected files and perform a DoS attack to a limited extent through an XSS vulnerability [1].

The vulnerability is present in product:

Synology Chat Server (DSM); =7.3; =7.2.2; =7.2.1

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

More information:

CVE-2026-9548 at cve.org, NVD
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 26. 5. 2026.

Synology Chat Server - information disclosure (CVE-2026-9491)

CVSS 4.3 (Medium)

An authenticated remote attacker can obtain information from the server through an SSRF vulnerability [1].

The vulnerability is present in product:

Synology Chat Server (DSM); =7.3; =7.2.2; =7.2.1

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

More information:

CVE-2026-9491 at cve.org, NVD
CWE-918: Server-Side Request Forgery (SSRF) at cwe.mitre.org

The vulnerability was publicly disclosed 26. 5. 2026.

Report feedback

[TLP:CLEAR] Synology Chat Server fixes 3 vulnerabilities

Synology Chat Server - arbitrary file read/write, DoS (CVE-2026-40541)

CVSS 9.0 (Critical)

Synology Chat Server - arbitrary file read/write, DoS (CVE-2026-9548)

CVSS 6.5 (Medium)

Synology Chat Server - information disclosure (CVE-2026-9491)

CVSS 4.3 (Medium)

Links