EIP-2026-101462

This exploit targets a race condition in Synology Photo Station's SYNOPHOTO_Flickr_MultiUpload function, allowing arbitrary file write and remote code execution. It bypasses authentication via session theft and leverages a race condition to write a malicious PHP file.