Read the docs
TI-2020-02203 Aliases CVE-2020-2491GHSA-whf5-659f-c55w

Cross-site Scripting Vulnerability in Photo Station

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. QTS 4.5.1: Photo Station 6.0.12 and later QTS 4.4.3: Photo Station 6.0.12 and later QTS 4.3.6: Photo Station 5.7.12 and later QTS 4.3.4: Photo Station 5.7.13 and later QTS 4.3.3: Photo Station 5.4.10 and later QTS 4.2.6: Photo Station 5.2.11 and later

Why it matters now

EPSS 0.00993 62nd percentileScored 2026-11-07
Fix Fixed Photo Station (QNAP Systems Inc.): 6.0.12, 5.7.12, 5.7.13 +2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPPhoto Stationbefore 6.0.12; before 5.7.12; before 5.7.13; before 5.4.10; before 5.2.116.0.12, 5.7.12, 5.7.13, 5.4.10, 5.2.11Patch availableCNA
  • Photo Station VendorQNAP Affected before 6.0.12; before 5.7.12; before 5.7.13; before 5.4.10; before 5.2.11 Fixed in 6.0.12, 5.7.12, 5.7.13, 5.4.10, 5.2.11 Patch available CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*before 6.0.12VulnerableQNAP
cpe:2.3:o:qnap:qts:4.5.1:*:*:*:*:*:*:*4.5.1Running onQNAP
cpe:2.3:o:qnap:qts:4.4.3:*:*:*:*:*:*:*4.4.3Running onQNAP
cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*before 5.7.12VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:*4.3.6Running onQNAP
cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*before 5.7.13VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:*4.3.4Running onQNAP
cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*before 5.4.10VulnerableQNAP
cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*4.3.3Running onQNAP
cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*before 5.2.11VulnerableQNAP
  • cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:* Versions before 6.0.12 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.5.1:*:*:*:*:*:*:* Versions 4.5.1 Running on ·QNAP
  • cpe:2.3:o:qnap:qts:4.4.3:*:*:*:*:*:*:* Versions 4.4.3 Running on ·QNAP
  • cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:* Versions before 5.7.12 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:* Versions 4.3.6 Running on ·QNAP
  • cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:* Versions before 5.7.13 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:* Versions 4.3.4 Running on ·QNAP
  • cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:* Versions before 5.4.10 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:* Versions 4.3.3 Running on ·QNAP
  • cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:* Versions before 5.2.11 Vulnerable ·QNAP
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:4.2.6:*:*:*:*:*:*:*4.2.6Running onQNAP
  • cpe:2.3:o:qnap:qts:4.2.6:*:*:*:*:*:*:* Versions 4.2.6 Running on ·QNAP

Remediation

  • Fix · CNA Photo Station (QNAP Systems Inc.) Fixed in 6.0.12, 5.7.12, 5.7.13, 5.4.10, 5.2.11

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-2491
  2. 2026-10-03 Alias added: GHSA-whf5-659f-c55w

References

Advisory 1

  • TI-2022-10581 DeadBolt Ransomware KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-05103 Path traversal in QNAP NAS devices running Photo Station KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05102 Path traversal in QNAP NAS devices running Photo Station KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05100 Incorrect authorization in QNAP NAS devices running Photo Station KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-14276 Information disclosure in QNAP Photo Station CVSS 3.1CRITICAL 9.8
  • TI-2021-19806 Improper authentication in Photo Station CVSS 3.1CRITICAL 9.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences