CVE-2025-66278
📋 TL;DR
A path traversal vulnerability in QNAP File Station 5 allows authenticated attackers to read arbitrary files on the system. This affects QNAP NAS devices running vulnerable versions of File Station 5. Attackers need valid user credentials to exploit this vulnerability.
💻 Affected Systems
- QNAP File Station 5
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading sensitive configuration files, password files, or SSH keys, potentially leading to lateral movement or ransomware deployment.
Likely Case
Unauthorized access to sensitive business documents, personal data, or system configuration information stored on the NAS.
If Mitigated
Limited data exposure restricted to files accessible by the compromised user account's permissions.
🎯 Exploit Status
Exploitation requires authenticated access but path traversal vulnerabilities are typically easy to exploit once authentication is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: File Station 5 5.5.6.5190 and later
Vendor Advisory: https://www.qnap.com/en/security-advisory/qsa-26-03
Restart Required: Yes
Instructions:
1. Log into QNAP App Center. 2. Check for updates to File Station 5. 3. Update to version 5.5.6.5190 or later. 4. Restart the NAS device to ensure the patch is fully applied.
🔧 Temporary Workarounds
Disable File Station
allTemporarily disable File Station 5 if immediate patching is not possible
Log into QTS/QuTS hero > Control Panel > Applications > File Station > Disable
Restrict User Access
allLimit File Station access to only essential users and implement strict access controls
Log into QTS/QuTS hero > Control Panel > Privilege > Users > Modify user permissions
🧯 If You Can't Patch
- Implement network segmentation to isolate QNAP devices from critical systems
- Enable detailed logging and monitoring for File Station access patterns
🔍 How to Verify
Check if Vulnerable:
Check File Station version in QNAP App Center. If version is below 5.5.6.5190, the system is vulnerable.Check Version:
Log into QTS/QuTS hero > App Center > Installed Apps > Check File Station versionVerify Fix Applied:
Verify File Station version shows 5.5.6.5190 or higher in App Center after update.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in File Station logs
- Multiple failed path traversal attempts in web server logs
- Access to system directories from File Station
Network Indicators:
- Unusual HTTP requests with directory traversal patterns (../ sequences) to File Station endpoints
SIEM Query:
source="qnap_logs" AND ("File Station" AND ("..\/" OR "%2e%2e%2f" OR directory traversal))