Any authenticated user, even with the lowest privilege, can download any system file, included the /etc/shadow, samba password files and files owned by the other DSM users, without any restriction. The vulnerability is located in "/webman/wallpaper.cgi". The CGI takes as parameter the full path of the image to download, encoded in ASCII Hex format. The problem is that any file type can be downloaded (not only images) and the path validation is very poor. In fact the CGI checks only if the path starts with an allowed directory (like /usr/syno/synoman/webman), and this kind of protection can be easily bypassed using the ../ attack. A command injection vulnerability, present on the "/webman/modules/ControlPanel/ modules/externaldevices.cgi" CGI, allows any administrative user to execute arbitrary commands on the system, with root privileges.