CVE-2026-40541: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Synology Synology Chat Server

This vulnerability in Synology Chat Server arises from improper input neutralization during web page generation, classified as a cross-site scripting (XSS) flaw. It affects versions prior to 2.4.5-22148. Exploitation requires remote authenticated user interaction through the UI. Successful exploitation can lead to arbitrary file read/write operations and denial-of-service attacks within the DSM environment. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, user interaction, and impacts confidentiality, integrity, and availability with high severity. No vendor advisory or patch information is currently available to confirm remediation status.

The vulnerability allows remote authenticated users to perform arbitrary file read and write operations and cause denial-of-service conditions on the affected Synology Chat Server and DSM. This compromises confidentiality, integrity, and availability of the system. The critical CVSS score reflects the potential for severe impact if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Synology Chat Server to trusted users only and monitor for suspicious activity. Avoid unnecessary UI interactions by authenticated users that could trigger the vulnerability.