CVE-2025-58463lowCWE-23

CVE-2025-58463: low-severity vulnerability in QNAP Systems Inc. Download Station

Download Station

Published

Follow this CVE+ Monitor Download Station

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.3epss 0.5%
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: Download Station 5.10.0.305 ( 2025/09/16 ) and later Download Station 5.10.0.304 ( 2025/09/08 ) and later
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:U
Affected products
QNAP Systems Inc. · Download Station
Related CVEs — QNAP Systems Inc. Download Station

In the same product, most dangerous first.

CVE-2026-39993HIGHPath Traversal to Root RCE in QNAP Download Station via Addon/Search addon ParameterEPSS 0.4%CVE-2026-39989MEDIUMSSRF in QNAP Download StationEPSS 0.3%CVE-2024-38640HIGHDownload StationEPSS 0.2%CVE-2025-58465LOWDownload StationEPSS 0.2%CVE-2026-34014HIGHds-move-files.sh is writable and executed as rootEPSS 0.1%