An improperly neutralized input vulnerability, classified as CWE‑79, exists in Synology Safe Access prior to version 1.3.1‑0329. The flaw allows a remote authenticated user with administrator privileges to inject JavaScript into dynamically generated web pages, enabling the attacker to read or write specific files that contain non‑sensitive information or to perform a limited denial‑of‑service attack against the Synology Remote Management (SRM) system.

The affected product is Synology Safe Access. Versions before 1.3.1‑0329 are vulnerable. No further version details are provided.

The CVSS score of 5.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, implying a lower known exploitation prevalence. Exploitation requires the attacker to be authenticated as an administrator; once logged in, the attacker can craft malicious input to trigger the XSS flaw. The impact includes unauthorized file read/write of non‑sensitive data and the ability to cause a limited denial‑of‑service.