This vulnerability involves improper neutralization of input during web page generation in Synology Contacts, which leads to a cross-site scripting issue. Authenticated remote users can exploit this flaw to read or write certain files that contain non-sensitive data. The vulnerability affects versions prior to 1.0.10-20659. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, user interaction, and partial impact on confidentiality and integrity without affecting availability.

Exploitation of this vulnerability could allow authenticated users to perform cross-site scripting attacks that result in reading or writing specific files with non-sensitive information. The impact is limited to confidentiality and integrity of non-sensitive data, with no impact on availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit access to Synology Contacts to trusted users and monitor for unusual activity. Avoid executing untrusted input in the contact functionality. Follow updates from Synology for any forthcoming patches.