CVE-2024-10443

CRITICAL 9.8CVE-2024-10443 · Published 15/11/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
beephotos synology	`< 1.0.2-10026< 1.1.0-10053`	`1.0.2-100261.1.0-10053`
photos synology	`< 1.6.2-0720< 1.7.0-0795`	`1.6.2-07201.7.0-0795`

Description

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synology BeePhotos before 1.0.2-10026 and 1.1.0-10053 and Synology Photos before 1.6.2-0720 and 1.7.0-0795 allows remote attackers to execute arbitrary code via unspecified vectors.

References

synology.com/en-global/security/advisory/Synology_SA_24_18 · Vendor Advisory
synology.com/en-global/security/advisory/Synology_SA_24_19 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free