The vulnerability stems from an origin validation error in the Synology ActiveProtect Agent. This flaw allows a local user to install the agent and place arbitrary files with restricted content on the system. The issue is identified as CWE‑346, indicating that the software lacks proper access control when validating incoming installation data, which can be abused to write files that have potentially malicious or unintended content.

Synology ActiveProtect Agent versions prior to 1.1.0-0439 are affected. The vulnerability applies to installations performed by any local user with sufficient privileges to run the agent’s installer on Synology devices.

The CVSS score of 6.1 reflects medium severity, and the EPSS score is currently unavailable, making it unclear how frequently this flaw is exploited in the wild. The vulnerability is not listed in CISA’s KEV catalog. Because the attack requires local installation privileges, the risk is limited to users with such permissions, but unrestricted file write capabilities can lead to broader system impacts if abused.