CVE-2025-54155

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5018 and later

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
QNAP Systems Inc.	File Station 5	>= 5.5.x, < 5.5.6.5018

References

https://www.qnap.com/en/security-advisory/qsa-26-03Vendor Advisory

Timeline

Published: Feb 11, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-541567.5The Sante PACS Server Web Portal sends credential information without encryption.CVE-2025-541575.4A reflected cross-site scripting (xss) vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870. A speci CVE-2025-541587.8Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local user CVE-2025-541597.5Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attackers to delete arbitr CVE-2025-54162.7A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure. While it requires an already authent CVE-2025-541607.8Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in BeeDrive in Synology BeeDrive for desktop be CVE-2025-541614.9An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains CVE-2025-541624.9A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can the CVE-2025-541634.9A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, th CVE-2025-541644.9An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an admini CVE-2025-541654.9An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an admini CVE-2025-541664.9An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an admini