CVE-2025-53413

MediumCVSS 6.5/10Last modified Oct 18, 2026

Description

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5018 and later

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
QNAP Systems Inc.	File Station 5	>= 5.5.x, < 5.5.6.5018

References

https://www.qnap.com/en/security-advisory/qsa-25-38Vendor Advisory

Timeline

Published: Nov 7, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-534144.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an a CVE-2025-534157.8Delta Electronics DTM Soft Project File Parsing Deserialization of Untrusted Data Remote Code Execution CVE-2025-534167.8Delta Electronics DTN Soft Project File Parsing Deserialization of Untrusted Data Remote Code Execution CVE-2025-534179.3DIAView (v4.2.0 and prior) - Directory Traversal Information Disclosure Vulnerability CVE-2025-534188.6Delta Electronics COMMGR has Stack-based Buffer Overflow vulnerability.CVE-2025-534197.8Delta Electronics COMMGR has Code Injection vulnerability.CVE-2025-53426.5Zohocorp ManageEngine Exchange Reporter Plus through 5721 are vulnerable to ReDOS vulnerability in the search module.CVE-2025-534207.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes WPLMS wplms_plugin allows R CVE-2025-534216.5Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Lev CVE-2025-534227.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeWarriors WhatsApp Chat for WordPr CVE-2025-534237.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Triss triss allows Reflec CVE-2025-534246.5Missing Authorization vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows Exploiting Incorrectly