CVE-2025-22490
published 2025-06-06CVE-2025-22490: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the…
PriorityP336high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.36%
28.4th percentile
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4847 and later
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| qnap | file_station | >= 5.5.6.4691 < 5.5.6.4847 | 5.5.6.4847 |
| qnap_systems_inc | file_station_5 | >= 5.5.x < 5.5.6.4847 | 5.5.6.4847 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-54wx-m542-wwfm: A NULL pointer dereference vulnerability has been reported to affect File Station 5
ghsa_unreviewed·2025-06-06
CVE-2025-22490 [MEDIUM] CWE-476 GHSA-54wx-m542-wwfm: A NULL pointer dereference vulnerability has been reported to affect File Station 5
A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.4847 and later
GHSA
The WikiManager REST API allows any user to create wikis
ghsa·2025-03-19
CVE-2025-29926 [HIGH] CWE-285 The WikiManager REST API allows any user to create wikis
The WikiManager REST API allows any user to create wikis
### Impact
Any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm.
Note that this REST API is not bundled in XWiki Standard by default: it needs to be installed manually through the extension manager.
### Patches
The problem has been patched in versions 15.10.15, 16.4.6 and 16.10.0 of the REST module.
### Workarounds
There's no workaround other than upgrading the dependency.
### References
* JIRA ticket: https://jira.xwiki.org/browse/XWIKI-22490
* Commit of the fix: https://github.com/xwiki/xwiki-platform/commit/82aa670106c7f5e6238ca6ed59a52d1800e05b99
### For more information
If you have any questions or comments about this
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-06-06
Published