{"id":"CVE-2025-66593","title":"An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation.","summary":"An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation.","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","cwe":["CWE-346"],"vendor":"synology","product":"assistant","affected":["assistant < 7.0.6-50085"],"patched":["assistant 7.0.6-50085"],"published":"2026-05-27","updated":"2026-09-30","sourceUpdated":"2026-09-30T21:10:00.190","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66593","references":[{"url":"https://www.synology.com/en-global/security/advisory/Synology_SA_25_17","label":"security@synology.com"}],"tags":["nvd"],"epss":0.00086,"epssPercentile":0.003,"ingestedAt":"2026-09-30T21:25:07.735Z","slug":"CVE-2025-66593","body":"## Overview\n\nAn origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation.\n\n## Affected\n\n- `assistant < 7.0.6-50085`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `assistant 7.0.6-50085`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}