# Synology MailPlus Server Critical Remote Code Execution and Arbitrary File Access (CVE-2026-13136, CVE-2025-15660, CVE-2026-13135)

> Three critical vulnerabilities in Synology MailPlus Server affect DSM 7.3, 7.2.2, and 7.2.1. CVE-2026-13136 (CVSS 10.0) enables unauthenticated remote attackers to read/write arbitrary files and trigger denial-of-service attacks. CVE-2025-15660 (CVSS 9.6) allows adjacent-network attackers to manipulate critical files. CVE-2026-13135 (CVSS 5.3) permits unauthorized access to internal services.

- **Published:** 2026-06-30T00:00:00Z
- **Last reviewed:** 2026-06-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1014
- **ID:** TL-2026-1014
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-13136, CVE-2025-15660, CVE-2026-13135

## Description

Synology MailPlus Server contains three distinct vulnerability chains that collectively enable complete system compromise. The primary vulnerability, CVE-2026-13136, is a critical path traversal and arbitrary file write vulnerability accessible to unauthenticated attackers over the network without any authentication requirement. The vulnerability stems from insufficient input validation in HTTP request handlers for file upload and management functionality. Attackers can craft specially-formed HTTP requests containing path traversal sequences (e.g., ../) to bypass directory restrictions and write arbitrary files to any location on the system with MailPlus Server process privileges. The secondary vulnerability, CVE-2025-15660, affects network-adjacent attackers and permits manipulation of configuration files and mail storage, potentially leading to credential theft and mailbox compromise. CVE-2026-13135 is an information disclosure vulnerability that exposes internal service endpoints and administrative APIs to unauthenticated access. Combined, these vulnerabilities enable attackers to: (1) achieve remote code execution by writing malicious scripts to accessible web directories or cron job locations; (2) manipulate mail storage and user configurations; (3) steal credentials and session tokens from configuration files; (4) enumerate internal infrastructure and services; (5) trigger denial-of-service through resource exhaustion or critical file corruption.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1036 Masquerading
- T1548 Abuse Elevation Control Mechanism
- T1056 Input Capture
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1046 Network Service Discovery
- T1005 Data from Local System
- T1114 Email Collection
- T1041 Exfiltration Over C2 Channel
- T1071 Application Layer Protocol
- T1499 Endpoint Denial of Service
- T1485 Data Destruction
- T1491 Defacement
- T1134 Access Token Manipulation
- T1550 Use Alternate Authentication Material
- T1070 Indicator Removal
- T1012 Query Registry
- T1074 Data Staged
- T1490 Inhibit System Recovery

## Sources

- [Synology MailPlus Server Vulnerabilities Advisory](https://www.synology.com/en-us/security/advisory)
- [Cyber Security News: Synology MailPlus Server Vulnerabilities](https://cybersecuritynews.com/synology-mailplus-server-vulnerabilities/)
- [CWE-22: Improper Limitation of a Pathname to a Restricted Directory](https://cwe.mitre.org/data/definitions/22.html)
- [MITRE ATT&CK: Abuse Elevation Control Mechanism](https://attack.mitre.org/techniques/T1548/)
- [CWE-426: Untrusted Search Path](https://cwe.mitre.org/data/definitions/426.html)
- [OWASP Path Traversal Vulnerability](https://owasp.org/www-community/attacks/Path_Traversal)
- [NVD CVE-2026-13136 Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-13136)
- [NVD CVE-2025-15660 Entry](https://nvd.nist.gov/vuln/detail/CVE-2025-15660)
- [NVD CVE-2026-13135 Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-13135)
- [Synology DiskStation Manager Security Releases](https://www.synology.com/en-us/support/security)
- [CISA Vulnerability Alerts and Advisories](https://www.cisa.gov/news-events/alerts-advisories)
- [Synology MailPlus Server Documentation](https://www.synology.com/en-us/dsm/7.2/help/MailPlus/MailPlus_desc)
- [HTTP Request Smuggling and Path Traversal in Web Servers](https://owasp.org/www-community/attacks/HTTP_Request_Smuggling)
- [File Upload Vulnerabilities and Restrictions Bypass](https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1014