QNAP Video Station: Path traversal allowing reading of unexpected files
Summary
A path traversal vulnerability in QNAP Video Station, an app for QNAP NAS devices, allows an attacker to read the contents of unexpected files or system data. The attacker must first obtain a valid user account on the device. The official CVE record also carries a conflicting title mentioning file deletion and code execution, which the vendor text and description do not support.
Affected
- QNAP Video Station 5.8.x before 5.8.5
- Earlier branches: Unknown.
Fixed in
- Video Station 5.8.5 and later (vendor reference: QNAP release notes)
- Newest release recommended; later Video Station CVEs are fixed in 5.8.8.
Workaround
- None documented by the vendor, because a fixed version exists.
- Interim measures (recommendation, not from a source): restrict and review NAS user accounts, remove unused accounts, and do not expose the NAS management or Video Station interfaces directly to the internet.
Exploitation
- Exploited in the wild: no evidence found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No public proof of concept found; VulDB states no available exploit.
Our recommendation
- Update Video Station to 5.8.5 or later, preferably the latest release (5.8.8 or later).
- Check which NAS devices run Video Station and verify the installed version in the App Center.
- Review and remove unused or former-staff user accounts and restrict account creation.
- Do not expose NAS management interfaces to the internet; monitor access logs for unusual file access.
- Confirm the authoritative CVSS score on NVD, as third-party scores differ.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- QNAP Video Station release notes (vendor reference) www.qnap.com
- VulDB CVE-2025-66272 (no exploit available) vuldb.com
- OpenCVE CVE-2025-66272 app.opencve.io
- Vulners VulnRichment CVE-2025-66272 (SSVC, prerequisites) vulners.com
- CVE Threatint CVE-2025-66272 cve.threatint.com
- VulDB CVE-2026-34015 (later path traversal fixed in 5.8.8) vuldb.com
- QNAP QSA-25-32 (different CVE, reference only) www.qnap.com
- CyberStrike CVE-2023-50360 (earlier authenticated Video Station flaw) cyberstrike.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 08:25.
Original description (NVD)
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.