{"id":"CVE-2019-7194","kind":"vulnerability","aliases":["CVE-2019-7194"],"related":[],"title":"qnap photo station: This external control of file name or path vulnerability allows remote attackers to access or modify system files","description":"QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.\n\nCISA required action: Apply updates per vendor instructions.","summary":"QNAP Photo Station on QNAP NAS devices has a path traversal flaw that lets remote attackers reach and modify system files. It is listed in CISA's Known Exploited Vulnerabilities catalog and flagged for ransomware use.","severity":"critical","cvss":9.8,"epss":0.82713,"exploited":true,"exploited_at":"2022-06-08T00:00:00+00:00","products":[{"name":"qnap photo station","fixed":["6.0.3"],"affected":"< 6.0.3","ecosystem":"vendor"},{"name":"qnap photo station","fixed":["5.7.10"],"affected":"< 5.7.10","ecosystem":"vendor"},{"name":"qnap photo station","fixed":["5.4.9"],"affected":"< 5.4.9","ecosystem":"vendor"},{"name":"qnap photo station","fixed":["5.2.11"],"affected":"< 5.2.11","ecosystem":"vendor"},{"name":"QNAP Photo Station","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","nas","photo-station","qnap","ransomware","self-hosted","vendor"],"not_affected_if":["photo-station-not-installed"],"how_to_check":"Open Photo Station version in the QTS App Center on the NAS and compare it to the QNAP advisory for CVE-2019-7194.","fix":"Apply the QNAP firmware and Photo Station update named in the vendor advisory; the sources do not give the fixed version.","status":"open","published_at":"2019-12-05T17:15:13+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:12:55+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T21:12:55Z","model":"claude-haiku-5-5","output":{"fix":"Apply the QNAP firmware and Photo Station update named in the vendor advisory; the sources do not give the fixed version.\nunknown","reach":"internet","impact":"high","summary":"QNAP Photo Station on QNAP NAS devices has a path traversal flaw that lets remote attackers reach and modify system files. It is listed in CISA's Known Exploited Vulnerabilities catalog and flagged for ransomware use.","category":"vendor","who_cares":["qnap","nas","photo-station","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote attackers read and modify system files on the NAS","analyst_note":"Find the QNAP advisory and the fixed Photo Station version, and confirm whether exposure requires internet-facing access; the sources here give neither.","how_to_check":"Open Photo Station version in the QTS App Center on the NAS and compare it to the QNAP advisory for CVE-2019-7194.\nunknown","needs_analyst":true,"not_affected_if":["photo-station-not-installed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000487,"input_tokens":2827,"output_tokens":408,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2019':23A,26A '-7194':24A,27A 'access':17A,109C 'action':116C 'allow':13A,105C 'appli':117C 'attack':15A,69B,107C 'catalog':84B 'cisa':79B,114C 'contain':95C 'control':6A,98C 'cve':22A,25A 'devic':60B,91C 'exploit':43B,82B 'extern':5A,97C 'file':8A,21A,74B,100C,113C 'flag':86B 'flaw':65B 'host':52B 'instruct':121C 'known':81B 'let':67B 'list':77B 'modifi':19A,72B,111C 'name':9A,101C 'nas':44B,59B 'path':11A,63B,103C 'per':119C 'photo':2A,29A,32A,35A,38A,41A,46B,55B,93C 'photo-st':45B 'qnap':1A,28A,31A,34A,37A,40A,48B,54B,58B,90C 'ransomwar':49B,88B 'reach':70B 'remot':14A,68B,106C 'requir':115C 'run':92C 'self':51B 'self-host':50B 'station':3A,30A,33A,36A,39A,42A,47B,56B,94C 'system':20A,73B,112C 'travers':64B 'updat':118C 'use':89B 'vendor':53B,120C 'vulner':12A,83B,104C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-12-05T17:15:13+00:00","kev":{"dateAdded":"2022-06-08","dueDate":"2022-06-22","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-7194","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-7194","severity":null,"published_at":"2022-06-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T20:35:35+00:00","note":null},{"source":"epss","external_id":"CVE-2019-7194","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-7194","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-7194","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7194","severity":null,"published_at":"2019-12-05T17:15:13+00:00","modified_at":"2026-06-17T02:40:14+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}