This vulnerability involves improper limitation of a pathname to a restricted directory in the Desktop API component of Synology DiskStation Manager (DSM). It enables remote attackers to perform path traversal attacks, allowing them to write certain files outside intended directories and potentially cause denial-of-service conditions. The issue affects DSM versions 7.2.1 prior to build 69057-10, 7.2.2 prior to build 72806-7, and 7.3 prior to build 86009-2. The CVSS 3.1 base score is 6.5, indicating medium severity with network attack vector, low attack complexity, no privileges or user interaction required, no confidentiality impact, limited integrity impact, and limited availability impact.

Remote attackers can exploit this vulnerability to write files in restricted directories, which may lead to limited denial-of-service conditions. There is no confidentiality impact reported. The integrity and availability impacts are limited but present.

Fixed versions are available: DSM 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. Users should upgrade to these or later versions to remediate the vulnerability. No additional mitigation guidance is provided or required beyond applying these official fixes.