TI-2026-02671 Aliases CVE-2026-3091 GHSA-fj46-cfm8-7pc4

Uncontrolled search path in Synology Presto Client

LOW 33CWE-427Published 2026-02-24 · Updated 2026-06-02

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.

Summary

An uncontrolled search path element vulnerability in Synology Presto Client before 2.1.3-0672 allows local users to read or write arbitrary files and conduct denial-of-service during installation by placing a malicious DLL in advance in the same directory as the installer.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00164 5th percentileScored 2026-11-07

Fix Fixed Synology Presto Client (Synology): 2.1.3-0672

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Synology	Synology Presto Client	before 2.1.3-0672	2.1.3-0672	Patch available	CNA

Synology Presto Client VendorSynology Affected before 2.1.3-0672 Fixed in 2.1.3-0672 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:synology:presto_client::::::::	before 2.1.3-0672	Vulnerable	Synology

cpe:2.3:a:synology:presto_client:*:*:*:*:*:*:*:* Versions before 2.1.3-0672 Vulnerable ·Synology

Remediation

Fix · CNA Synology Presto Client (Synology) Fixed in 2.1.3-0672

Timeline

2026-10-02 Threatist record created from CVE-2026-3091
2026-10-03 Alias added: GHSA-fj46-cfm8-7pc4

References

Advisory 1

Synology-SA-26:02 Synology Presto Client

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences