A vulnerability in the Notification API of Synology DiskStation Manager (DSM) before versions 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write specific files due to improper neutralization of input during web page generation. This issue is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability has a CVSS 3.1 base score of 5.4, indicating a medium severity level.