CVE-2024-48864

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A files or directories accessible to external parties vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers to read/write files or directories.

We have already fixed the vulnerability in the following versions: File Station 5 5.5.6.4741 and later

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-552

Affected software

Vendor	Product	Versions
QNAP Systems Inc.	File Station 5	>= 5.5.x, < 5.5.6.4741

References

https://www.qnap.com/en/security-advisory/qsa-24-55Vendor Advisory

Timeline

Published: Mar 7, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-488657.5An improper certificate validation vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulne CVE-2024-488665.3An improper handling of URL encoding (Hex Encoding) vulnerability has been reported to affect several QNAP operating system versions. If exp CVE-2024-488677.5An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system vers CVE-2024-488687.5An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system vers CVE-2024-488696.1Improper restriction of software interfaces to hardware features for some Intel(R) Xeon(R) 6 processor with E-cores when using Intel(R) Trus CVE-2024-48877.5The Qi Addons For Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.2 via the 'CVE-2024-488704.8Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability CVE-2024-488719.8The affected product is vulnerable to a stack-based buffer overflow. An unauthenticated attacker could send a malicious HTTP request that th CVE-2024-488724.8Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, and 9.5.x <= 9.5.12 fail to prevent concurrently checking and upda CVE-2024-488735.5In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: check return value of ieee80211_probereq_get() for RNR Th CVE-2024-488749.8Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could give attackers the ability to force Ruijie's proxy servers to perform CVE-2024-488755.5In the Linux kernel, the following vulnerability has been resolved: btrfs: don't take dev_replace rwsem on task already holding it Running