CVE-2025-1021 Missing authorization in DiskStation Manager (DSM)

What is CVE-2025-1021?

CVE-2025-1021 is a high-severity missing authorization vulnerability in Synology Diskstation Manager, published on 23 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Missing authorization vulnerability in synocopy in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows remote attackers to read arbitrary files via unspecified vectors.

Weakness: CWE-862

Which versions are affected by CVE-2025-1021?

It affects 1 product.

Products include Synology Diskstation Manager.

How do I fix CVE-2025-1021?

No fix has been published for CVE-2025-1021 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-1021 being exploited?

There is no known exploitation of CVE-2025-1021 in the wild and no public exploit code.

Other vulnerabilities in Synology Diskstation Manager

• CVE-2022-27624 Memory corruption in DiskStation Manager (DSM) Critical 10.0
• CVE-2022-27625 Memory corruption in DiskStation Manager (DSM) Critical 10.0
• CVE-2022-27626 Race condition in DiskStation Manager (DSM) Critical 10.0
• CVE-2013-6955 Path traversal in n/a Critical 10.0
• CVE-2022-22687 Memory corruption in DiskStation Manager (DSM) Critical 9.8

All Synology Diskstation Manager vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5h3w-59m5-q6wr.