Description
A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data.
We have already fixed the vulnerability in the following versions:
Download Station 5.10.0.305 ( 2025/09/16 ) and later
Download Station 5.10.0.304 ( 2025/09/08 ) and later
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| QNAP Systems | Download Station | 5.10.x – < 5.10.0.305 ( 2025/09/16 ), 5.10.x – < 5.10.0.304 ( 2025/09/08 ) | 5.10.0.305 ( 2025/09/16 ) |