CVE-2026-39993
8.7HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-23
Impact
Authenticated attackers can read arbitrary system files and data over the network. They need a valid user account to exploit the issue.
Root cause
A relative path traversal vulnerability allows unauthorized file access outside the intended directory.
Affected systems
Download Station versions prior to 5.10.2.313 (for 5.10.x branch) and prior to 5.11.3.322 (for 5.11.x branch).
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade Download Station to 5.10.2.313, 5.11.3.322, or later. If updating immediately is not possible, disable or stop the Download Station application via QTS App Center.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Download Station 5.10.2.313 and later Download Station 5.11.3.322 and later