CVE-2017-16772 - AskarLabs CVE Database

CVE-2017-16772

Vendor Synology

Product Photo Station

Weakness CWE-434 · Unrestricted file upload

Published March 22, 2018

Last update September 17, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improper input validation vulnerability in SYNOPHOTO_Flickr_MultiUpload in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote authenticated users to execute arbitrary codes via the prog_id parameter.

Key dates

02Disclosure timeline

March 22, 2018 CVE published

September 17, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2017-16772 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2024-2531 MAGESH-K21 Online-College-Event-Hall-Reservation-System update-rooms.php unrestricted upload CVE-2025-11655 Total.js Flow SVG File unrestricted upload CVE-2025-14583 campcodes Online Student Enrollment System register.php unrestricted upload CVE-2022-40981 ETIC Telecom Remote Access Server Unrestricted Upload of File with Dangerous Type CVE-2023-1392 SourceCodester Online Pizza Ordering System save_menu unrestricted upload

Identifiers

CVE CVE-2017-16772

CWE CWE-434

Affected versions

Vendor Synology

Product Photo Station

Affected before 6.8.3-3463

Vendor Synology

Product Photo Station

Affected before 6.3-2971