The vulnerability is a path traversal flaw in the Archiving Pull functionality of Synology Surveillance Station. It allows remote authenticated users with administrator privileges to write files through unspecified vectors, representing a CWE‑22 weakness. The flaw does not provide arbitrary code execution or complete system compromise, but enables controlled file writes within the system.

Synology Surveillance Station deployments running versions prior to 9.2.2‑11575 and 9.2.2‑9575 are affected. The issue exists in all earlier builds before these release identifiers published by Synology.

With a CVSS score of 2.7 the vulnerability is considered low severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a remote authenticated account with administrator privileges and the Archiving Pull feature enabled. The impact is limited to the ability to write files to the filesystem via unsanitized path traversal, without direct provision for arbitrary code execution or system compromise. Mitigation focuses on applying the vendor patch or restricting access to the vulnerable interface.