Vulnerability intelligence

CVE-2026-9548

Synology Synology Chat Server CWE-79

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks in DSM.

CVSS Score

6.5

Medium

EPSS — Exploit Probability

0.2%

Riskier than 15% of all CVEs · checked 2026-09-05

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories