Qnap File Station vulnerabilities

CVE-2025-57707 [HIGH] CWE-96 CVE-2025-57707: An improper neutralization of directives in statically saved code ('Static Code Injection') vulnerab An improper neutralization of directives in statically saved code ('Static Code Injection') vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to access restricted data / files. We have already fixed the vulnerability in the following version: File Station 5 5.5.

CVE-2024-48864 [CRITICAL] CWE-552 CVE-2024-48864: A files or directories accessible to external parties vulnerability has been reported to affect File A files or directories accessible to external parties vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers to read/write files or directories. We have already fixed the vulnerability in the following versions: File Station 5 5.5.6.4741 and later

CVE-2025-29885 [HIGH] CWE-295 CVE-2025-29885: An improper certificate validation vulnerability has been reported to affect File Station 5. If expl An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who have gained user access to compromise the security of the system. We have already fixed the vulnerability in the following versions: File Station 5 5.5.6.4791 and later and later

CVE-2025-29883 [HIGH] CWE-295 CVE-2025-29883: An improper certificate validation vulnerability has been reported to affect File Station 5. If expl An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who have gained user access to compromise the security of the system. We have already fixed the vulnerability in the following versions: File Station 5 5.5.6.4791 and later and later

CVE-2025-22486 [HIGH] CWE-295 CVE-2025-22486: An improper certificate validation vulnerability has been reported to affect File Station 5. If expl An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who have gained user access to compromise the security of the system. We have already fixed the vulnerability in the following versions: File Station 5 5.5.6.4791 and later and later

CVE-2025-29884 [HIGH] CWE-295 CVE-2025-29884: An improper certificate validation vulnerability has been reported to affect File Station 5. If expl An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who have gained user access to compromise the security of the system. We have already fixed the vulnerability in the following versions: File Station 5 5.5.6.4791 and later and later

CVE-2025-30279 [HIGH] CWE-295 CVE-2025-30279: An improper certificate validation vulnerability has been reported to affect File Station 5. If a re An improper certificate validation vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4847 and later

CVE-2025-33031 [HIGH] CWE-295 CVE-2025-33031: An improper certificate validation vulnerability has been reported to affect File Station 5. If a re An improper certificate validation vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4847 and later

CVE-2026-24724 [HIGH] CWE-863 CVE-2026-24724: An incorrect authorization vulnerability has been reported to affect File Station 6. If a remote att An incorrect authorization vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass intended access restrictions. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

CVE-2026-26241 [CRITICAL] CWE-121 CVE-2026-26241: A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

CVE-2026-26240 [CRITICAL] CWE-121 CVE-2026-26240: A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

CVE-2025-47206 [HIGH] CWE-787 CVE-2025-47206: An out-of-bounds write vulnerability has been reported to affect File Station 5. If a remote attacke An out-of-bounds write vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4933 and later

CVE-2026-26239 [HIGH] CWE-121 CVE-2026-26239: A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gai A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5208 and later

CVE-2025-57713 [HIGH] CWE-1390 CVE-2025-57713: A weak authentication vulnerability has been reported to affect File Station 5. The remote attackers A weak authentication vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to gain sensitive information. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5166 and later

CVE-2025-29872 [HIGH] CWE-770 CVE-2025-29872: An allocation of resources without limits or throttling vulnerability has been reported to affect Fi An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following ver

CVE-2025-62853 [MEDIUM] CWE-22 CVE-2025-62853: A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gain A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5166 and later

CVE-2026-22894 [MEDIUM] CWE-22 CVE-2026-22894: A path traversal vulnerability has been reported to affect File Station 6. If a remote attacker gain A path traversal vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5190 and later

CVE-2025-66278 [MEDIUM] CWE-22 CVE-2025-66278: A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gain A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5190 and later

CVE-2025-33035 [MEDIUM] CWE-22 CVE-2025-33035: A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gai A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4847 and later

CVE-2025-54169 [MEDIUM] CWE-125 CVE-2025-54169: An out-of-bounds read vulnerability has been reported to affect File Station 5. If a remote attacker An out-of-bounds read vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5068 and later