CVE-2026-40541

CriticalCVSS 9.0/10Last modified Sep 1, 2026

Description

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 28, 2026
Last modified: Sep 1, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-405427.3Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authenticati CVE-2026-405438.8SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoint CVE-2026-405445.1SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via /process/upload_backup endpoint. An authenticated attacker with access to CVE-2026-405455.1SOPlanning is vulnerable to Reflected XSS via the taches parameter. An attacker can craft a malicious URL which, when opened by authenticate CVE-2026-405468.7SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters. Attacker with low privileges can inject arbitrary SQL co CVE-2026-405476.4SOPlanning is vulnerable to Path Traversal in backup endpoints. Authenticated remote attacker is able to exploit a vulnerable endpoint and CVE-2026-405486.4SOPlanning does not verify uploaded file extension. An authenticated attacker with access to the backup functionality can upload a crafted Z CVE-2026-405495.1SOPlanning is vulnerable to Cross‑Site Request Forgery (CSRF) in groupe_save create, modify and delete endpoints. An attacker can craft a ma CVE-2026-40554.3Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run CVE-2026-405506.9Multiple BinSoft products are vulnerable to Privilege Escalation due to excessive database privileges assigned to the user used by the appli CVE-2026-405518.4Multiple BinSoft products perform client-side authentication. An attacker with access to any application instance connected to the backend s CVE-2026-405524.7Multiple BinSoft products are vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to