This vulnerability in Synology DSM's Upload API allows remote authenticated users to control file names or paths externally, enabling them to write arbitrary files to the system and potentially cause denial-of-service attacks. The issue affects multiple DSM versions prior to the specified fixed releases. The CVSS 3.1 base score is 8.1, indicating high severity, with attack vector network, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact.

Exploitation of this vulnerability can lead to integrity and availability impacts by allowing attackers with valid credentials to write arbitrary files, potentially overwriting critical system files or causing service disruption through denial-of-service. Confidentiality is not impacted according to the CVSS vector.

Fixed versions are available: 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. Users should upgrade to these or later versions to remediate the vulnerability. No information about alternative mitigations or vendor advisories indicating no action required is provided.