TI-2017-08868 Aliases CVE-2017-12074 GHSA-mqph-37g3-x4m7

Path traversal in Synology DNS Server

LOW 33CWE-22Published 2017-08-24 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

Directory traversal vulnerability in the SYNO.DNSServer.Zone.MasterZoneConf in Synology DNS Server before 2.2.1-3042 allows remote authenticated attackers to write arbitrary files via the domain_name parameter.

Why it matters now

EPSS 0.01989 80th percentileScored 2026-11-07

Fix Fixed Synology DNS Server (Synology): 2.2.1-3042

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Synology	Synology DNS Server	before 2.2.1-3042	2.2.1-3042	Patch available	CNA

Synology DNS Server VendorSynology Affected before 2.2.1-3042 Fixed in 2.2.1-3042 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:synology:dns_server::::::::	up to 2.2.0-3032	Vulnerable	Synology

cpe:2.3:a:synology:dns_server:*:*:*:*:*:*:*:* Versions up to 2.2.0-3032 Vulnerable ·Synology

Remediation

Fix · CNA Synology DNS Server (Synology) Fixed in 2.2.1-3042

Timeline

2026-10-02 Threatist record created from CVE-2017-12074
2026-10-03 Alias added: GHSA-mqph-37g3-x4m7

References

Advisory 1

https://www.synology.com/en-global/support/security/Synology_SA_17_46_DNS_Server

TI-2020-06916 A flaw in native PKCS#11 code can lead to a remotely triggerable assertion failure in pk11.c CVSS 3.1HIGH 7.5
TI-2022-10596 Path traversal in Synology DNS Server CVSS 3.1HIGH 8.1
TI-2020-06915 A truncated TSIG response can lead to an assertion failure CVSS 3.1MEDIUM 6.5
TI-2020-06914 Attempting QNAME minimization after forwarding can lead to an assertion failure in resolver.c CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences