CVE-2021-47960

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access files within the installation directory via a local HTTP server bound to the loopback interface. By leveraging user interaction with a crafted web page, attackers may retrieve sensitive files such as configuration files, certificates, and logs, leading to information disclosure.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-552

Affected software

Vendor	Product	Versions
Synology	Synology SSL VPN Client	< 1.4.5-0684

References

https://www.synology.com/en-global/security/advisory/Synology_SA_26_05Vendor Advisory

Timeline

Published: Apr 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-479618.1A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence CVE-2021-479626.4Savsoft Quiz 5.0 contains a persistent cross-site scripting vulnerability in the user account settings page that allows authenticated attack CVE-2021-479637.2Anote 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to execute arbitrary code by injecting malicious pa CVE-2021-479648.8Schlix CMS 2.2.6-6 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploa CVE-2021-479659.8WordPress Plugin WP Super Edit 2.5.4 and earlier contains an unrestricted file upload vulnerability in the FCKeditor component that allows a CVE-2021-479668.2PHP Timeclock 1.04 contains time-based and boolean-based blind SQL injection vulnerabilities in the login_userid parameter of login.php that CVE-2021-479676.1PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScrip CVE-2021-479686.4Podcast Generator 3.1 is vulnerable to persistent cross-site scripting, allowing authenticated attackers to inject malicious scripts by subm CVE-2021-479697.5Color Notes 1.4 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long charac CVE-2021-479707.5Macaron Notes 5.5 contains a denial of service vulnerability that allows attackers to crash the application by creating notes with excessive CVE-2021-479717.5My Notes Safe 5.3 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long char CVE-2021-479727.5Sticky Notes & Color Widgets 1.4.2 contains a denial of service vulnerability that allows attackers to crash the application by creating not