TI-2021-12734 Aliases CVE-2021-33183 GHSA-m65h-2c6x-9769

Path traversal in Synology Docker

LOW 34CWE-22Published 2021-06-01 · Updated 2024-09-17

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability container volume management component in Synology Docker before 18.09.0-0515 allows local users to read or write arbitrary files via unspecified vectors.

Why it matters now

EPSS 0.00285 21st percentileScored 2026-11-07

Fix Fixed Synology Docker (Synology): 18.09.0-0515

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Synology	Synology Docker	before 18.09.0-0515	18.09.0-0515	Patch available	CNA

Synology Docker VendorSynology Affected before 18.09.0-0515 Fixed in 18.09.0-0515 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:synology:docker::::::::	before 18.09.0-0515	Vulnerable	Synology

cpe:2.3:a:synology:docker:*:*:*:*:*:*:*:* Versions before 18.09.0-0515 Vulnerable ·Synology

Remediation

Fix · CNA Synology Docker (Synology) Fixed in 18.09.0-0515

Timeline

2026-10-02 Threatist record created from CVE-2021-33183
2026-10-03 Alias added: GHSA-m65h-2c6x-9769

References

Advisory 1

https://www.synology.com/security/advisory/Synology_SA_21_08

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences