Path Traversal Vulnerability in QNAP File Station Software
CVE-2025-33035

7.2HIGH

Key Information:

Vendor

QNAP
Status
File Station 5
Vendor
CVE Published:
6 June 2025

What is CVE-2025-33035?

A path traversal vulnerability in QNAP File Station 5 allows remote attackers with valid user accounts to gain unauthorized access to sensitive files and system data. This flaw can be exploited to read files outside of the intended directories, compromising the integrity and confidentiality of the system. Users are urged to update to File Station 5 version 5.5.6.4847 or later to mitigate the risk associated with this vulnerability.

Affected Version(s)

File Station 5 5.5.x < 5.5.6.4847

References

https://www.qnap.com/en/security-advisory/qsa-25-16

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

coral
.
CVE-2025-33035 : Path Traversal Vulnerability in QNAP File Station Software