A cross-site scripting flaw in Synology Chat Server carries a CVSS 9.0 rating because it breaks scope and lets authenticated users read or write arbitrary files and trigger denial-of-service conditions in DSM.
What Is It
CVE-2026-40541 is an improper neutralization of input during web page generation, cross-site scripting (CWE-79), in the extract domain of Synology Chat Server. Synology assigned the CVE and published the record on 2026-08-28.
The vulnerability allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, giving a base score of 9.0 (CRITICAL) with an exploitability subscore of 2.3 and an impact subscore of 6.0.
Why It Matters
The severity here is driven by scope change (S:C). This is nominally an XSS bug, but the impact does not stay inside the Chat Server web application; it reaches DSM, the underlying Synology operating system, with high confidentiality, integrity, and availability impact.
The barriers to exploitation are low: network attack vector, low attack complexity, and only low privileges required. The one meaningful gate is required user interaction. Arbitrary file write on a NAS platform is a serious outcome, and the same flaw supports denial-of-service against DSM.
There is no CISA KEV entry supplied for this CVE, so there is no confirmed evidence of active exploitation in the wild at this time, and no federally mandated remediation deadline.
What's Vulnerable
- Vendor: Synology
- Product: Synology Chat Server
- Affected versions: all versions before 2.4.5-22148 (default status: affected)
No specific CPE entries were listed in the NVD record. The vulnerability status is "Received," meaning the record has not yet completed NVD analysis and enrichment.
Patch Status
Synology has released a fixed version. Upgrade Synology Chat Server to 2.4.5-22148 or later. The vendor advisory is Synology_SA_26_10. Because exploitation requires an authenticated user, reviewing who holds accounts on exposed Chat Server instances is a reasonable interim step, but patching is the fix.
Sources
- NVD, CVE-2026-40541: https://nvd.nist.gov/vuln/detail/CVE-2026-40541
- Synology Security Advisory SA_26_10: https://www.synology.com/en-global/security/advisory/Synology_SA_26_10