This vulnerability involves improper limitation of a pathname to a restricted directory in the Archiving Pull feature of Synology Surveillance Station prior to versions 9.2.2-11575 and 9.2.2-9575. Remote authenticated users with administrator privileges can perform limited file write operations via unspecified vectors, potentially enabling unauthorized file placement. The CVSS 3.1 base score is 2.7, reflecting low severity with network attack vector, low complexity, and required high privileges. No official remediation level or patch information is provided in the available data.

The impact is limited to integrity, allowing an authenticated administrator to write files outside intended directories. There is no impact on confidentiality or availability. The low CVSS score and requirement for administrator privileges reduce the overall risk. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted personnel only and monitor for unusual file write activities related to the Archiving Pull functionality. Do not assume the vulnerability is mitigated without vendor confirmation.