QNAP Systems Inc. Download Station vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting QNAP Systems Inc. Download Station: 5 record(s), with affected versions and fixes.
CVE-2026-39989
Medium · 5.3
CWE-918 Oct 15, 2026
SSRF in QNAP Download Station
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data.
We have already fixed the vulnerability in the following version:
Download Station 5.10.1.312 and later
Download Station 5.11.2.321 and later
CVE-2026-34014
High · 8.4
CWE-732 Oct 15, 2026
ds-move-files.sh is writable and executed as root
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following version:
Download Station 5.10.1.312 and later
Download Station 5.11.2.321 and later
CVE-2026-39993
High · 8.7
CWE-23 Oct 15, 2026
Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Download Station 5.10.2.313 and later
Download Station 5.11.3.322 and later
CVE-2025-58465
Medium · 5.4
CWE-79 Nov 7, 2025
Download Station
A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data.
We have already fixed the vulnerability in the following versions:
Download Station 5.10.0.305 ( 2025/09/16 ) and later
Download Station 5.10.0.304 ( 2025/09/08 ) and later
CVE-2025-58463
Medium · 4.9
CWE-23 Nov 7, 2025
Download Station
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following versions:
Download Station 5.10.0.305 ( 2025/09/16 ) and later
Download Station 5.10.0.304 ( 2025/09/08 ) and later