Relative Path Traversal Vulnerability in Download Station by QNAP
CVE-2025-58463

2.3LOW

Key Information:

Vendor

QNAP
Status
Download Station
Vendor
CVE Published:
7 November 2025

What is CVE-2025-58463?

A relative path traversal vulnerability in Download Station allows a remote attacker, possessing administrator credentials, to exploit the system and access sensitive files or data that are normally restricted. This exposure can lead to unauthorized data disclosure and compromise of system integrity. It is crucial for users to upgrade to the fixed versions to mitigate potential risks.

Affected Version(s)

Download Station 5.10.x < 5.10.0.305 ( 2025/09/16 )

Download Station 5.10.x < 5.10.0.304 ( 2025/09/08 )

References

https://www.qnap.com/en/security-advisory/qsa-25-37

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tim Coen
JSON
.
CVE-2025-58463 : Relative Path Traversal Vulnerability in Download Station by QNAP