Active Backup for Business contains a vulnerability that allows remote attackers to read arbitrary files. The weakness is identified as an injection flaw (CWE‑89), indicating that malicious input can manipulate database queries or other processing paths to disclose data. This yields a confidentiality breach, potentially exposing sensitive configuration, credentials, or backup content, though no denial of service or code execution is noted.

Synology Active Backup for Business is affected. No specific version information is provided in the advisory, so all deployed instances are treated as vulnerable until a patch is applied.

The CVSS score of 8.6 classifies the vulnerability as high severity. EPSS is not available, but the CVE is not listed in the CISA KEV catalog, indicating that large‑scale exploitation has not yet been confirmed. The attack vector is inferred to be remote, requiring network access to the Active Backup service, and relies on the injection flaw to read files without authentication. While the required conditions are relatively simple, the potential impact on data confidentiality is substantial.