CVE-2025-66275
7.7HighPublished 15 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-22
Impact
Authenticated attackers can read arbitrary files and sensitive system data across the device. They need valid user account credentials on the system to exploit this over the network.
Root cause
Improper input sanitization allows path traversal (CWE-22) in file handling requests.
Affected systems
QNAP Video Station versions prior to 5.8.5.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade Video Station to version 5.8.5 or later via the QTS App Center. If you cannot update immediately, stop or disable the Video Station application.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later