cve/2017/CVE-2017-15895.md

### [CVE-2017-15895](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15895)
![](https://img.shields.io/static/v1?label=Product&message=Synology%20Router%20Manager%20(SRM)&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20(CWE-22)&color=brighgreen)

### Description

Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology Router Manager (SRM) before 1.1.5-6542-4 allows remote authenticated users to write arbitrary files via the dest_folder_path parameter.

### POC

#### Reference
- https://www.synology.com/en-global/support/security/Synology_SA_17_71_SRM

#### Github
No PoCs found on GitHub currently.