CVE-2026-39993highCWE-23

CVE-2026-39993: falha de alta gravidade em QNAP Systems Inc. Download Station

Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter

Publicada em

Seguir esta CVE+ Monitorar Download Station

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.4%
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Download Station 5.10.2.313 and later Download Station 5.11.3.322 and later
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
QNAP Systems Inc. · Download Station
CVEs relacionadas — QNAP Systems Inc. Download Station

No mesmo produto, das mais perigosas para as menos.

CVE-2025-58463LOWDownload StationEPSS 0.5%CVE-2026-39989MEDIUMSSRF in QNAP Download StationEPSS 0.3%CVE-2024-38640HIGHDownload StationEPSS 0.2%CVE-2025-58465LOWDownload StationEPSS 0.2%CVE-2026-34014HIGHds-move-files.sh is writable and executed as rootEPSS 0.1%