Vulnerabilidades do QNAP Systems Inc. Download Station
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam QNAP Systems Inc. Download Station: 5 registro(s), com versões afetadas e correções.
CVE-2026-39989
Média · 5.3
CWE-918 15/10/2026
SSRF in QNAP Download Station
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data.
We have already fixed the vulnerability in the following version:
Download Station 5.10.1.312 and later
Download Station 5.11.2.321 and later
CVE-2026-34014
Alta · 8.4
CWE-732 15/10/2026
ds-move-files.sh is writable and executed as root
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following version:
Download Station 5.10.1.312 and later
Download Station 5.11.2.321 and later
CVE-2026-39993
Alta · 8.7
CWE-23 15/10/2026
Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Download Station 5.10.2.313 and later
Download Station 5.11.3.322 and later
CVE-2025-58465
Média · 5.4
CWE-79 07/11/2025
Download Station
A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data.
We have already fixed the vulnerability in the following versions:
Download Station 5.10.0.305 ( 2025/09/16 ) and later
Download Station 5.10.0.304 ( 2025/09/08 ) and later
CVE-2025-58463
Média · 4.9
CWE-23 07/11/2025
Download Station
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following versions:
Download Station 5.10.0.305 ( 2025/09/16 ) and later
Download Station 5.10.0.304 ( 2025/09/08 ) and later