CVE-2026-22899

MediumCVSS 6.5/10Last modified Jul 23, 2026

Description

A NULL pointer dereference vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.

We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5208 and later

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

No affected versions have been published.

Timeline

Published
Jun 10, 2026
Last modified
Jul 23, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-22903.8The Post Affiliate Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.28.0. This CVE-2026-229009.8A use of hard-coded credentials vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vulnerabiliCVE-2026-229019.8A command injection vulnerability has been reported to affect QuNetSwitch. If a remote attacker gains a user account, they can then exploit CVE-2026-229026.7A command injection vulnerability has been reported to affect QuNetSwitch. If a local attacker gains an administrator account, they can thenCVE-2026-229039.8An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffCVE-2026-229049.8Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversizedCVE-2026-229057.5An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and using path traversal sequences (eCVE-2026-229069.8User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration fiCVE-2026-229079.1An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data.CVE-2026-229089.1Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity CVE-2026-229099.1Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, CVE-2026-22917.3dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, whic