CVE-2025-66272
7.7HighPublished 15 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-22
Impact
Authenticated attackers can read arbitrary system files or data remotely. They need valid user credentials on the QNAP device first.
Root cause
Improper input sanitization allows path traversal via user-supplied file paths.
Affected systems
QNAP Video Station versions prior to 5.8.5.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade Video Station to version 5.8.5 or later through the QNAP App Center; as an interim workaround, stop or disable the Video Station application.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later