---
id: "CVE-2018-19943"
kind: "vulnerability"
aliases: ["CVE-2018-19943"]
title: "QNAP Network Attached Storage (NAS): QNAP NAS File Station Cross-Site Scripting Vulnerability"
severity: "high"
cvss: 8.0
epss: 0.22682
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "QNAP Network Attached Storage (NAS)", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "file-station", "infrastructure", "nas", "qnap", "ransomware", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2020-10-28T18:15:12+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-19943", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-19943", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19943", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# QNAP Network Attached Storage (NAS): QNAP NAS File Station Cross-Site Scripting Vulnerability

QNAP NAS File Station has a cross-site scripting flaw that lets remote attackers inject malicious script. An attacker can run script in a logged-in user's browser session on the NAS web interface, which the sources tie to ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:QNAP Network Attached Storage (NAS) affected ? fixed ?

## How to check

Confirm the NAS model and firmware version under Control Panel > System in the QNAP web UI; the sources do not give affected version ranges.

## Fix

Apply the QNAP firmware and File Station updates per the vendor instructions referenced by CISA; the sources do not name the fixed version.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-19943
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2018-19943
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-19943

## From the sources

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_