Critical9.8QNAP Exploited CISA KEV
Photo Station: This external control of file name or path vulnerability allows remote attackers to access or modify system files.
CVE-2019-7194 Published Dec 5, 2019Updated by vendor Jun 17, 2026
CVE-2019-7194
Affected products & platforms
QNAPUnclassified
Summary
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
CISA Known Exploited Vulnerability
- Listed:
- Jun 8, 2022 · federal remediation due Jun 22, 2022
- Required action:
- Apply updates per vendor instructions.
- Ransomware use:
- Known
KEV is a prioritization signal from CISA — remediation detail still comes from the vendor advisory.
Mitigation
Mitigation steps weren't captured by the parser for this advisory — this is a parsing gap, not a statement that no fix exists. Read the vendor advisory below for the authoritative guidance.
Official advisory · medium-confidence parse· fetched 3 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.