Read the docs
TI-2025-36220 Aliases CVE-2025-58463GHSA-cc6p-pmxf-h4wh

Path traversal in QNAP Download Station

Priority LOW 13CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: Download Station 5.10.0.305 ( 2025/09/16 ) and later Download Station 5.10.0.304 ( 2025/09/08 ) and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00499 43rd percentileScored 2026-11-07
Fix Fixed Download Station (QNAP Systems Inc.): 5.10.0.305 ( 2025/09/16 ), 5.10.0.304 ( 2025/09/08 )

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPDownload Station5.10.x to before 5.10.0.305 ( 2025/09/16 ); 5.10.x to before 5.10.0.304 ( 2025/09/08 )5.10.0.305 ( 2025/09/16 ), 5.10.0.304 ( 2025/09/08 )Patch availableCNA
  • Download Station VendorQNAP Affected 5.10.x to before 5.10.0.305 ( 2025/09/16 ); 5.10.x to before 5.10.0.304 ( 2025/09/08 ) Fixed in 5.10.0.305 ( 2025/09/16 ), 5.10.0.304 ( 2025/09/08 ) Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:qnap:download_station:5.10.0.291:*:*:*:*:*:*:*5.10.0.291VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:*h5.2.1.2929 build_20241025Running onQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:*h5.2.1.2940 build_20241105Running onQNAP
cpe:2.3:a:qnap:download_station:*:*:*:*:*:*:*:*5.10.0.291 to before 5.10.0.305VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:*5.2.1.2930 build_20241025Running onQNAP
  • cpe:2.3:a:qnap:download_station:5.10.0.291:*:*:*:*:*:*:* Versions 5.10.0.291 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:* Versions h5.2.1.2929 build_20241025 Running on ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:* Versions h5.2.1.2940 build_20241105 Running on ·QNAP
  • cpe:2.3:a:qnap:download_station:*:*:*:*:*:*:*:* Versions 5.10.0.291 to before 5.10.0.305 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:* Versions 5.2.1.2930 build_20241025 Running on ·QNAP

Remediation

  • Fix · CNA Download Station (QNAP Systems Inc.) Fixed in 5.10.0.305 ( 2025/09/16 ), 5.10.0.304 ( 2025/09/08 )

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    QNAP Systems Download Station 5.10.0.304 ( 2025/09/08 ), 5.10.0.305 ( 2025/09/16 )

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2025-36222 Cross-site scripting in QNAP Download StationPriority LOW 11
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-58463
  2. 2026-10-03 Alias added: GHSA-cc6p-pmxf-h4wh

References

Advisory 1

  • TI-2024-25875 Cross-site scripting in QNAP Download Station CVSS 4.0HIGH 7.0
  • TI-2025-36222 Cross-site scripting in QNAP Download Station CVSS 4.0LOW 2.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences