An origin validation error in Synology Assistant before version 7.0.6‑50085 allows a local user to write arbitrary files with restricted content during the installation process. The flaw effectively bypasses the expected origin checks and permits unauthorized creation or modification of critical files, which could be leveraged to alter system configuration or drop malicious payloads. The impact is confined to the local system where the installation occurs, potentially leading to unauthorized code execution or data integrity violations for that user or the device as a whole.

Synology Assistant running on Synology NAS devices, any release prior to 7.0.6‑50085. The vulnerability affects the assistant component that handles software installation and package deployment, and it requires a user with local administrative or installation privileges.

The CVSS score of 6.1 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting limited known exploitation. The attack vector is local; an adversary needs a legitimate local account and must trigger the installation routine. Because the flaw allows writing arbitrary files during installation, an attacker could inject malicious configuration or executable files that the Synology Assistant later processes, potentially leading to denial of service or elevation of privileges on the affected device.