Live › vulnerability › CVE-2019-7195
Go to dashboardQNAP NAS devices running Photo Station have a path traversal flaw in which user-supplied file names are not restricted, so remote attackers can read or modify system files. CISA lists it as actively exploited in the wild, and the tags mark it as used in ransomware campaigns.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| qnap photo station | vendor | < 6.0.3 | 6.0.3 |
| qnap photo station | vendor | < 5.7.10 | 5.7.10 |
| qnap photo station | vendor | < 5.4.9 | 5.4.9 |
| qnap photo station | vendor | < 5.2.11 | 5.2.11 |
| QNAP Photo Station | vendor | – | – |
Log in to the QNAP web admin and open App Center to see the installed Photo Station version; the affected and fixed versions are unknown from the sources.
s fixed release per QNAPs advisory; the exact version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2019-7195")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.