This vulnerability involves improper neutralization of input during web page generation in the Video API component of Synology DiskStation Manager (DSM). It affects DSM versions >=7.2.1 and <7.2.1-69057-10, >=7.2.2 and <7.2.2-72806-7, and >=7.3 and <7.3.2-86009-2. Exploitation requires remote authenticated access and results in limited file read or write capabilities when the media player is launched. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with a scope change and limited confidentiality and integrity impact but no availability impact.

Remote authenticated users can exploit this XSS vulnerability to read or write limited files on the affected DSM system when launching the player. This could lead to partial compromise of confidentiality and integrity of data within the scope of the affected component. There is no impact on availability. The vulnerability requires user interaction and privileges, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no vendor advisory or patch links are provided, users should monitor Synology's official security advisories for updates and apply any official fixes once available. In the meantime, restrict access to the affected DSM versions to trusted users only and consider minimizing use of the vulnerable Video API features.