Skip to content
OpenAdvisories
High · 7.7 CVE-2025-66272 EUVD-2025-211093GHSA-82vv-gqxj-gp73

Arbitrary file deletion and remote code execution

Published Oct 15, 2026 · Updated Oct 15, 2026 · Assigned by qnap

Description

A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version:
Video Station 5.8.5 and later

Affected products

VendorProductAffectedFixed
QNAP Systems Video Station 5.8.x – < 5.8.5 5.8.5

References