This vulnerability in Synology Active Backup for Business involves improper neutralization of special elements used in SQL commands, commonly known as SQL injection. It allows remote attackers with no privileges or user interaction to read arbitrary files, potentially exposing sensitive information. The CVSS 3.1 base score is 8.6, reflecting a high impact on confidentiality with no impact on integrity or availability. The vulnerability is publicly disclosed but lacks an official fix or patch as of the published date.

Successful exploitation can lead to unauthorized disclosure of sensitive files on the affected system, compromising confidentiality. There is no impact on integrity or availability according to the CVSS vector. The vulnerability can be exploited remotely without authentication, increasing the risk of data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently documented, users should monitor Synology's security advisories closely. Until a patch is available, consider restricting network access to the affected service to trusted sources only.