CVE-2025-66272: QNAP Video Station: Video Station: path traversal vulnerability
This QNAP advisory covers CVE-2025-66272 in Video Station.
- CVE-2025-66272
Key facts
- Vendor rating
- High, CVSS 7.7
- CISA KEV
- Not listed (catalogue checked )
- Affected
- Video Station 5.8.x before 5.8.5
- Fixed in
- Video Station 5.8.5
- Source published
- Source revised
- Listed by VulniPulse
- Record changed
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later
Text from the source record.
- Video Station 5.8.x before 5.8.5
NVD record · high-confidence parse· fetched ·verify at source
How to fix CVE-2025-66272
Upgrade to a fixed release named by QNAP:
- Video Station 5.8.5
More QNAP advisories
CVE-2026-44084Oct 15, 2026Video Station: Video Station: authorization bypass through user-controlled keyCVE-2026-34015Oct 15, 2026Video Station: Video Station: path traversal vulnerabilityCVE-2026-26245Oct 15, 2026Video Station: Video Station: SQL injection vulnerabilityCVE-2026-26244Oct 15, 2026Video Station: Video Station: SQL injection vulnerabilityCVE-2025-66275Oct 15, 2026Video Station: Video Station: path traversal vulnerabilityCVE-2023-34977Oct 13, 2023Video Station: Video Station: cross-site scripting (XSS) vulnerability
Get an email when QNAP Applications publishes the next one.
See QNAP Applications's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future QNAP CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
