Read the docs
TI-2017-11639 Aliases CVE-2017-15892GHSA-f262-299x-rch2

Cross-site scripting in Synology Chat

Priority LOW 26CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Slash Command Creator in Synology Chat before 2.0.0-1124 allow remote authenticated users to inject arbitrary web script or HTML via (1) COMMAND, (2) COMMANDS INSTRUCTION, or (3) DESCRIPTION parameter.

Why it matters now

EPSS 0.01014 63rd percentileScored 2026-11-07
Fix Fixed Chat (Synology): 2.0.0-1124

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SynologyChatbefore 2.0.0-11242.0.0-1124Patch availableCNA
  • Chat VendorSynology Affected before 2.0.0-1124 Fixed in 2.0.0-1124 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:synology:chat:*:*:*:*:*:*:*:*before 2.0.0-1124VulnerableSynology
  • cpe:2.3:a:synology:chat:*:*:*:*:*:*:*:* Versions before 2.0.0-1124 Vulnerable ·Synology

Remediation

  • Fix · CNA Chat (Synology) Fixed in 2.0.0-1124

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-15892
  2. 2026-10-03 Alias added: GHSA-f262-299x-rch2

References

Advisory 1

  • TI-2017-11633 Server-side request forgery in Synology Chat CVSS 3.0MEDIUM 6.5
  • TI-2017-08205 Server-side request forgery in Synology Chat CVSS 3.0MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences