CVE-2025-29844 MEDIUM

CVE-2025-29844

Vendor Synology
Product Synology Router Manager (SRM)
Weakness CWE-22 · Path traversal
Published December 4, 2025
Last update December 4, 2025
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

A vulnerability in FileStation file cgi allows remote authenticated users to read file metadata and path information.

Key dates

02Disclosure timeline

December 4, 2025 CVE published
December 4, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-49991 RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection CVE-2026-13528 YunaiV/zhijiantianya ruoyi-vue-pro AppFileController File Upload Endpoint FileServiceImpl.java generateUploadPath path traversal CVE-2026-48314 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) CVE-2026-44017 Docling: Unsafe Zip Extraction in EasyOCR Model Download CVE-2026-13503 antlr ANTLR4 tokenVocab Grammar Option TokenVocabParser.java getImportedVocabFile path traversal