CVE-2022-36534: Syncovery 9 for Linux web GUI authenticated RCE via job parameters

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityAuthenticated RCE with public exploit references and very high EPSS, though it requires valid credentials and is not in KEV.

What it is

Syncovery 9 for Linux v9.47x and below contains multiple remote code execution flaws reached through the Job_ExecuteBefore and Job_ExecuteAfter parameters at post_profilesettings.php. An authenticated user can inject commands that execute on the host, making this a serious post-authentication compromise path. The record does not specify the exact injection mechanism or affected build list beyond v9.47x and below.

Impact

An attacker with a valid account gains arbitrary command execution on the Syncovery host, allowing full compromise of the server and any data or credentials it can reach.

Attack surface

Reached over the network through the Syncovery web GUI at post_profilesettings.php; the CVSS vector shows PR:L and UI:N, so a low-privileged authenticated account is required and no user interaction is needed.

Exploitation

Not listed in CISA KEV, but public exploit write-ups exist (Packet Storm and mgm-sp references tagged Exploit) and EPSS is 0.52 at the 98.9th percentile, indicating elevated near-term exploitation likelihood.

What to do

• Upgrade Syncovery 9 for Linux beyond v9.47x to a fixed release from the vendor.
• Restrict network access to the Syncovery web GUI to trusted management networks.
• Audit and minimize accounts with access to profile settings; remove unused or shared logins.
• Review job configurations for unexpected Job_ExecuteBefore and Job_ExecuteAfter values.
• Monitor and alert on command execution spawned by the Syncovery service account.

Detection

• Alert on POST requests to post_profilesettings.php containing shell metacharacters or command strings in Job_ExecuteBefore or Job_ExecuteAfter.
• Monitor child processes spawned by the Syncovery service account for shells or unexpected binaries.
• Review web server and Syncovery logs for profile settings changes followed by process creation on the host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.