What’s Vulnerable › Products

QNAP Systems Inc. Download Station vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your QNAP Systems Inc. Download Station version is affected

Latest QNAP Systems Inc. Download Station vulnerabilities

• CVE-2026-39989 — SSRF in QNAP Download Station (CVSS 5.3)
• CVE-2026-34014 — ds-move-files.sh is writable and executed as root (CVSS 8.4)
• CVE-2026-39993 — Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter (CVSS 8.7)
• CVE-2025-58465 — Download Station (CVSS 5.4)
• CVE-2025-58463 — Download Station (CVSS 4.9)
• CVE-2024-38640 — Download Station (CVSS 5.4)