Live › vulnerability › CVE-2019-7194
Go to dashboardQNAP Photo Station on QNAP NAS devices has a path traversal flaw that lets remote attackers reach and modify system files. It is listed in CISA's Known Exploited Vulnerabilities catalog and flagged for ransomware use.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| qnap photo station | vendor | < 6.0.3 | 6.0.3 |
| qnap photo station | vendor | < 5.7.10 | 5.7.10 |
| qnap photo station | vendor | < 5.4.9 | 5.4.9 |
| qnap photo station | vendor | < 5.2.11 | 5.2.11 |
| QNAP Photo Station | vendor | – | – |
Open Photo Station version in the QTS App Center on the NAS and compare it to the QNAP advisory for CVE-2019-7194.
Apply the QNAP firmware and Photo Station update named in the vendor advisory; the sources do not give the fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2019-7194")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.