CVE-2025-52861

HighCVSS 7.0/10Last modified Oct 18, 2026

Description

A path traversal vulnerability has been reported to affect VioStor. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version: VioStor 5.1.6 build 20250621 and later

Metrics

CVSS 4.0 7.0/10CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
QNAP Systems Inc.VioStor>= 5.1.0, < 5.1.6 build 20250621

References

Timeline

Published
Aug 29, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-528624.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an aCVE-2025-528638.1A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user accounCVE-2025-528648.1A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user accounCVE-2025-528656.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can theCVE-2025-528664.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an aCVE-2025-528676.5An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, theCVE-2025-528688.1A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit CVE-2025-528698.1A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit CVE-2025-52877.5The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and includCVE-2025-528708.1A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit CVE-2025-528716.5An out-of-bounds read vulnerability has been reported to affect License Center. If a remote attacker gains a user account, they can then expCVE-2025-528728.1A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user accoun
CVE-2025-52861: High severity, CVSS 7.0 | Vulnix