The vulnerability is an improper limitation of a pathname to a restricted directory (path traversal) in the Backup.Repository web API of Synology Hyper Backup. It allows remote authenticated users who have administrator privileges to write specific files containing non-sensitive information via unspecified vectors. The adversary could place arbitrary files, potentially affecting system operation or local data, but cannot access sensitive data directly. The weakness is CWE-22.

Synology Hyper Backup versions prior to 4.1.2-4036 are affected. This includes current releases of DSM 7.x running Hyper Backup, such as on Synology model DS224+ and other DS devices. Administrators on affected installations are at risk if no patch is applied. Version information is limited to pre-4.1.2-4036.

The CVSS score of 4.1 indicates a moderate severity; the EPSS score is not available, so current exploitation likelihood is unknown. The vulnerability is not listed in the CISA KEV catalog. Attack requires remote authentication and administrator level privileges. If exploited, an attacker could write files that could modify configuration or disrupt operation but cannot extract sensitive data directly. The overall risk remains moderate pending remediation.