CVE-2019-7194: QNAP Photo Station Path Traversal Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2022-06-08
EPSS: 82.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-12-05 · updated 2026-06-17
Weakness: CWE-22

Description

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.

Affected products

QNAP Systems Inc. Photo Station: before 6.0.3; before 5.7.10; before 5.4.9; before 5.2.11 — fixed in 5.2.11, 5.4.9, 5.7.10, 6.0.3

How to fix

Upgrade to a fixed version: QNAP Systems Inc. Photo Station 5.2.11, 5.4.9, 5.7.10, 6.0.3. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html
https://www.qnap.com/zh-tw/security-advisory/nas-201911-25
http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html
https://www.qnap.com/zh-tw/security-advisory/nas-201911-25
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7194

Get alerted when CVE-2019-7194 or the next vulnerability affects your stack