CVE-2026-9548: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Synology Synology Chat Server

This vulnerability in Synology Chat Server arises from improper input neutralization during web page generation, leading to cross-site scripting (XSS). Authenticated remote users can leverage this flaw through user interface interactions to access or modify restricted files and perform limited denial-of-service attacks on DSM. The issue affects versions prior to 2.4.5-22148. No official patch or remediation level has been disclosed by the vendor as of the published date.

Exploitation allows remote authenticated users to read or write restricted files and conduct limited denial-of-service attacks on the DSM environment. This can lead to confidentiality, integrity, and availability impacts within the affected system. The CVSS vector indicates network attack vector, low attack complexity, required privileges, user interaction, and scope change with low confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Synology's advisories for updates. Until a patch is available, restrict access to the Synology Chat Server to trusted users and limit privileges to reduce risk.