CVE-2025-54162

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5068 and later

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22CWE-73

Affected software

No affected versions have been published.

Timeline

Published
Feb 11, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-541634.9A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, thCVE-2025-541644.9An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an adminiCVE-2025-541654.9An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an adminiCVE-2025-541664.9An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an adminiCVE-2025-541677.2A cross-site scripting (XSS) vulnerability has been reported to affect Notification Center. If a remote attacker gains an administrator accoCVE-2025-541684.8A cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center. If a remote attacker gains an administrator account, thCVE-2025-541696.5An out-of-bounds read vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then expCVE-2025-54176.1An insufficient access control vulnerability was found in the Red Hat Developer Hub rhdh/rhdh-hub-rhel9 container image. The Red Hat DevelopCVE-2025-541706.5An out-of-bounds read vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then explCVE-2025-541724.8QuickCMS is vulnerable to Stored XSS in sTitle parameter in page editor functionality. Malicious attacker with admin privileges can inject aCVE-2025-541744.3QuickCMS is vulnerable to Cross-Site Request Forgery in article creation functionality. Malicious attacker can craft special website, which CVE-2025-541756.1QuickCMS.EXT is vulnerable to Reflected XSS in sFileName parameter in thumbnail viewer functionality.  An attacker can craft a malicious URL