CVE-2026-26244: QNAP Video Station: Video Station: SQL injection vulnerability
This QNAP advisory covers CVE-2026-26244 in Video Station.
- CVE-2026-26244
Key facts
- Vendor rating
- High, CVSS 7.1
- CISA KEV
- Not listed (catalogue checked )
- Affected
- Video Station 5.8.x before 5.8.8
- Fixed in
- Video Station 5.8.8
- Source published
- Source revised
- Listed by VulniPulse
- Record changed
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
Text from the source record.
- Video Station 5.8.x before 5.8.8
NVD record · high-confidence parse· fetched ·verify at source
How to fix CVE-2026-26244
Upgrade to a fixed release named by QNAP:
- Video Station 5.8.8
More QNAP advisories
CVE-2026-44084Oct 15, 2026Video Station: Video Station: authorization bypass through user-controlled keyCVE-2026-34015Oct 15, 2026Video Station: Video Station: path traversal vulnerabilityCVE-2026-26245Oct 15, 2026Video Station: Video Station: SQL injection vulnerabilityCVE-2025-66275Oct 15, 2026Video Station: Video Station: path traversal vulnerabilityCVE-2025-66272Oct 15, 2026Video Station: Video Station: path traversal vulnerabilityCVE-2023-34977Oct 13, 2023Video Station: Video Station: cross-site scripting (XSS) vulnerability
Get an email when QNAP Applications publishes the next one.
See QNAP Applications's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future QNAP CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
