CVE-2025-66278

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5190 and later

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
QNAP Systems Inc.	File Station 5	>= 5.5.x, < 5.5.6.5190

References

https://www.qnap.com/en/security-advisory/qsa-26-03Vendor Advisory

Timeline

Published: Feb 11, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-662797.2A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administ CVE-2025-662807.2An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gai CVE-2025-662817.2A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then e CVE-2025-662844.8Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, an CVE-2025-662864.7An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP re CVE-2025-662878.8A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.CVE-2025-662898.8OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application does not invalidate existing s CVE-2025-662904.3OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application’s recruitment attachment retri CVE-2025-662914.3OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the interview attachment retrieval endpoint in CVE-2025-662928.1DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /CVE-2025-662937.1LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. CVE-2025-662948.8Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows