CVE-2025-66272
A path traversal vulnerability has been reported to affect Video Station.
Published Oct 15, 2026 · updated Oct 15, 2026 · QNAP Systems Inc. Video Station
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later
Oct 15, 2026 · NIST NVD
Updated
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later
Oct 15, 2026 · NIST NVD
Updated
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later
Affected
- vendor QNAP Systems Inc. Video Stationversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2025-66272
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version:
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2025-66272
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2025-66272
30-day exploitation probability 0.4%
first.org - NIST NVDVulnerability recordCVE-2025-66272
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version:
nvd.nist.gov