CVE-2026-39989
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station.
Published Oct 15, 2026 · updated Oct 15, 2026 · QNAP Systems Inc. Download Station
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later
Oct 15, 2026 · NIST NVD
Updated
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later
Oct 15, 2026 · NIST NVD
Updated
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later
Affected
- vendor QNAP Systems Inc. Download Stationversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-39989
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-39989
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-39989
30-day exploitation probability 0.4%
first.org - NIST NVDVulnerability recordCVE-2026-39989
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Downloa
nvd.nist.gov