Advisories · Technology

QNAP Systems Inc. Download Station.

Every CVE that names QNAP Systems Inc. Download Station among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-39989 CVE record

CVSS 5.3 Medium

SSRF in QNAP Download Station
- QNAP Systems Inc. Download Station
- Server-side request forgery (SSRF)
Not analysed yet 15 Oct 2026
CVE-2026-34014 CVE record

CVSS 8.4 High

ds-move-files.sh is writable and executed as root
- QNAP Systems Inc. Download Station
- Broken access control
Not analysed yet 15 Oct 2026
CVE-2026-39993 CVE record

CVSS 8.7 High

Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter
- QNAP Systems Inc. Download Station
- Path traversal
Not analysed yet 15 Oct 2026
CVE-2025-58463 CVE record

CVSS 2.3 Low

Download Station
- QNAP Systems Inc. Download Station
- Path traversal
Not analysed yet 7 Nov 2025
CVE-2025-58465 CVE record

CVSS 2.2 Low

Download Station
- QNAP Systems Inc. Download Station
- Cross-site scripting (XSS)
Not analysed yet 7 Nov 2025
CVE-2024-38640 CVE record

CVSS 7.0 High

Download Station
- QNAP Systems Inc. Download Station
- Cross-site scripting (XSS)
Not analysed yet 6 Sept 2024