QNAP Video Station: Path traversal allows reading unexpected files
Summary
QNAP Video Station contains a path traversal vulnerability (CWE-22) that is tracked with a CVSS 4.0 score of 8.7. An attacker with a valid user account can use it to read the contents of unexpected files or system data on the NAS. The attack requires authentication, and the vendor has fixed the issue in version 5.8.8. The CNA record title mentions remote code execution, but the description and CWE describe file read; the vendor advisory should be checked to confirm the impact.
Affected
- QNAP Video Station 5.8.x before 5.8.8 (per CNA record)
- Some third-party databases list different ranges; older branches have not been verified against the QNAP advisory.
Fixed in
- Video Station 5.8.8 and later
Workaround
- No workaround documented. Upgrading is the fix.
- Interim: restrict Video Station accounts, remove unused accounts, and do not expose the NAS or Video Station interface directly to the internet.
Exploitation
- No evidence of known exploitation found; CISA SSVC lists exploitation as none and automatable as no.
- No public proof of concept found.
- EPSS 0.00493 (very low).
Our recommendation
- Inventory QNAP NAS devices and Video Station versions.
- Update Video Station to 5.8.8 or later via the QNAP App Center and check the QNAP advisory.
- Review NAS user accounts, enforce strong passwords and MFA where available, and remove unused accounts.
- Ensure the NAS is not directly reachable from the internet; use VPN for remote access.
- Review NAS logs for unusual Video Station requests and file access.
- Check for other Video Station path traversal and SQL injection CVEs published at the same time, such as CVE-2025-66272.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- QNAP release notes www.qnap.com
- OpenCVE CVE-2026-34015 app.opencve.io
- Threatint CVE-2026-34015 cve.threatint.com
- Vulners CVE-2026-34015 vulners.com
- VulDB 420583 vuldb.com
- Strix CVE-2026-34015 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:32.
Original description (NVD)
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.