From the related article: These two pre-installed aps are RCE vulnerable
BlockquoteSynology Photos (Synology-SA-24:19) and BeePhotos (Synology-SA-24:18), both of which come pre-installed and enabled by default on Synology’s consumer line of Bee network storage devices. The Photos app is also a popular download among users of the DiskStation systems.
Patches are available here: