TI-2022-06946 Aliases CVE-2022-22685 GHSA-8wg2-h7mh-v5qc

Path traversal in Synology WebDAV Server

MEDIUM 40CWE-22Published 2022-07-28 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology WebDAV Server before 2.4.0-0062 allows remote authenticated users to delete arbitrary files via unspecified vectors.

Why it matters now

EPSS 0.01284 70th percentileScored 2026-11-07

Fix Fixed WebDAV Server (Synology): 2.4.0-0062

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Synology	WebDAV Server	before 2.4.0-0062	2.4.0-0062	Patch available	CNA

WebDAV Server VendorSynology Affected before 2.4.0-0062 Fixed in 2.4.0-0062 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:synology:webdav_server::::::::	before 2.4.0-0062	Vulnerable	Synology

cpe:2.3:a:synology:webdav_server:*:*:*:*:*:*:*:* Versions before 2.4.0-0062 Vulnerable ·Synology

Remediation

Fix · CNA WebDAV Server (Synology) Fixed in 2.4.0-0062

Timeline

2026-10-02 Threatist record created from CVE-2022-22685
2026-10-03 Alias added: GHSA-8wg2-h7mh-v5qc

References

Advisory 1

https://www.synology.com/security/advisory/Synology_SA_21_09

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences