Synology Chat Server Flaw: When a Chat Message Can Reach Your Files

A heads-up, not a sales pitch

Part of what we do here at store.tyo.com.au is keep an eye on the steady stream of security advisories affecting the kit small businesses actually run — so you don't have to read them all yourself. This week, one is worth passing on to anyone with a Synology NAS in the office, which in Australia is a lot of small businesses.

Synology has just published the technical details behind security advisory SA-26:10, covering three vulnerabilities in Synology Chat Server — the Slack-style team messaging package that runs on DSM, the operating system on Synology NAS devices. The fix has actually existed since May; the details only became public on 28 August 2026, which is why it's in the news now. If you run Chat Server, this is your prompt to make sure the update is installed. If you don't, there's still a useful lesson here about the software living on your NAS.

What happened, in plain English

The advisory covers three flaws, all fixed in Chat Server version 2.4.5-22148, which is available for DSM 7.3, 7.2.2 and 7.2.1:

• CVE-2026-40541 (CVSS 9.0) — a cross-site scripting (XSS) flaw in Chat Server's link-preview handling. A logged-in user can craft content that, when another user interacts with it, can read or write arbitrary files on the NAS and disrupt DSM itself — not just the chat app.
• CVE-2026-9548 (CVSS 6.5) — a similar XSS flaw with a smaller blast radius: restricted file access and limited denial of service.
• CVE-2026-9491 (CVSS 4.3) — a server-side request forgery (SSRF) issue in Chat Server's webhook feature, which a logged-in user could use to obtain non-sensitive information.

Now the honest nuances, because they matter. None of these is an anonymous, internet-wide takeover. In every case the attacker needs a valid account on your Chat Server, and for the two XSS flaws they also need another user to interact with the malicious content — think clicking on a booby-trapped message. None of the three appears on CISA's Known Exploited Vulnerabilities list, and at the time of writing there are no reports of them being exploited in the wild.

So why does the headline flaw score a 9.0 — well into 'critical' territory — when it needs a login and a click? Because of what security folk call a scope change: the vulnerability starts in the chat application but breaks out into DSM, the NAS operating system underneath. A bug in a messaging app that ends with someone reading or overwriting the files on your file server is a very different beast from a bug that stays inside the messaging app.

One more date worth noticing: Synology shipped the fixed version on 26 May 2026 but held back the technical details until 28 August. That's normal, responsible practice — and it means anyone whose NAS auto-updates its packages was protected roughly three months before attackers could read exactly how the flaw works.

Why it matters: your NAS is a platform, not a box

The real lesson isn't about Synology, or even about chat software. It's that a modern NAS isn't a single device — it's a small server running a collection of add-on packages, each with its own update stream. Plenty of businesses dutifully update DSM firmware and assume the job is done. It isn't: Chat Server, and packages like it, are updated separately through Package Center, and an out-of-date package can undermine an otherwise patched NAS.

The second lesson is that 'authenticated' doesn't mean 'safe'. The natural reaction to 'the attacker needs an account' is relief — nobody outside the company can touch it. But think about what accounts exist on a typical office chat server: every current staff member, sometimes former ones, occasionally a contractor. A phished set of staff credentials, a departed employee whose account was never removed, or simply one disgruntled insider is all it takes to turn 'can send chat messages' into 'can read the company's files'. Small organisations are especially prone to treating everything inside the network as trusted — a habit we've written about before in can your network spot an intruder?

And third: the quiet-patch pattern. Vendors routinely fix first and disclose later, and attackers routinely reverse-engineer patches to work out what was fixed. The practical takeaway is to patch when the fix ships, not when the story breaks — by the time a vulnerability makes the news, the update has often been sitting there for months.

The honest bit

To be fair to Synology: this is what good vendor behaviour looks like. The flaws were reported through proper channels — credited to cyber-security specialists from Singapore's Digital and Intelligence Service and CSIT, along with an independent researcher — fixed promptly, and disclosed in coordination months later. No vendor is immune to vulnerabilities, including the ones we like and sell; what separates them is how they respond, and this response was solid.

There is one broader observation worth making, though. The window between 'fix available' and 'fix installed' is where almost all real-world compromises happen, and it's why we're generally fans of equipment and software that updates itself rather than waiting for a human to notice. It's the same reason cloud-managed firewalls keep getting better after you buy them — patches arrive whether or not anyone remembered to check. On a Synology NAS you can get much of that benefit just by flipping a setting, which brings us to the checklist.

What we'd suggest you actually do

1. Check whether Chat Server is installed. On your NAS, open Package Center and look for Synology Chat Server. If it's not there, this advisory doesn't affect you — but steps 3–6 are still worth doing.
2. Update it now. You need version 2.4.5-22148 or above. Synology lists no workaround or mitigation — updating is the fix.
3. Turn on automatic updates for both DSM and packages (Package Center → Settings), or at least a regular update schedule. This is the single change that would have had you covered back in May.
4. Audit the accounts on your NAS. Remove former staff and stale contractor logins, and give people only the access they need. Every dormant account is a spare key you've forgotten about.
5. Cover the basics: unique passwords and two-factor authentication on DSM accounts, especially administrators.
6. Don't expose the NAS directly to the internet. Check your router for port forwards to the NAS (commonly 5000/5001); prefer a VPN or Synology's QuickConnect over open ports, and disable remote admin access you don't use.

While you're at it, add the NAS — and its packages — to the same simple patch list you keep for your router, firewall and access points. Forgotten gear is how small networks get burned; it's the same pattern we saw with end-of-life Cisco RV routers, just wearing a different badge.

The friendly takeaway

This one has a happy shape: the fix has existed for three months, there's no evidence anyone has been exploited, and bringing yourself up to date is a ten-minute job. The flaws do need an account and (for the serious ones) a user interaction — but the worst of them can reach the files on your NAS, which is exactly the sort of thing worth ten minutes.

We'll keep watching these feeds — that's part of what you get from a local supplier who pays attention. And if you'd ever like a second pair of eyes over your network or your NAS setup, get in touch. No hard sell; sometimes a quick sanity check is all a small business needs.

References

• Synology Security Advisory SA-26:10 — Synology Chat Server
• NVD: CVE-2026-40541
• NVD: CVE-2026-9548
• NVD: CVE-2026-9491
• CISA Known Exploited Vulnerabilities Catalog (checked 29 August 2026 — none of these CVEs is listed)