This vulnerability involves improper limitation of a pathname to a restricted directory in Synology Hyper Backup's Backup Task functionality. Remote authenticated users can exploit this flaw to write files to arbitrary locations by bypassing directory restrictions. The CVSS 3.1 base score is 4.3, reflecting low attack complexity and the need for authentication, with impact limited to integrity. No vendor advisory or patch information is currently available to confirm remediation status.

The vulnerability allows remote authenticated users to write files outside the intended backup directory, potentially leading to unauthorized modification of files (integrity impact). There is no impact on confidentiality or availability according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Backup Task functionality to trusted users only and monitor for suspicious activity related to file writes.