{"id":"CVE-2019-7195","kind":"vulnerability","aliases":["CVE-2019-7195"],"related":[],"title":"qnap photo station: This external control of file name or path vulnerability allows remote attackers to access or modify system files","description":"QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.\n\nCISA required action: Apply updates per vendor instructions.","summary":"QNAP NAS devices running Photo Station have a path traversal flaw in which user-supplied file names are not restricted, so remote attackers can read or modify system files. CISA lists it as actively exploited in the wild, and the tags mark it as used in ransomware campaigns.","severity":"critical","cvss":9.8,"epss":0.89681,"exploited":true,"exploited_at":"2022-06-08T00:00:00+00:00","products":[{"name":"qnap photo station","fixed":["6.0.3"],"affected":"< 6.0.3","ecosystem":"vendor"},{"name":"qnap photo station","fixed":["5.7.10"],"affected":"< 5.7.10","ecosystem":"vendor"},{"name":"qnap photo station","fixed":["5.4.9"],"affected":"< 5.4.9","ecosystem":"vendor"},{"name":"qnap photo station","fixed":["5.2.11"],"affected":"< 5.2.11","ecosystem":"vendor"},{"name":"QNAP Photo Station","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","nas","photo-station","qnap","ransomware","self-hosted"],"not_affected_if":["not-qnap","photo-station-not-installed"],"how_to_check":"Log in to the QNAP web admin and open App Center to see the installed Photo Station version; the affected and fixed versions are unknown from the sources.","fix":"Update Photo Station and QNAP firmware to the vendor's fixed release per QNAP's advisory; the exact version is unknown from the sources.\nRestrict NAS admin and Photo Station access from the internet until patched.","status":"open","published_at":"2019-12-05T17:15:13+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:12:54+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:12:54Z","model":"claude-haiku-5-5","output":{"fix":"Update Photo Station and QNAP firmware to the vendor's fixed release per QNAP's advisory; the exact version is unknown from the sources.\nRestrict NAS admin and Photo Station access from the internet until patched.","reach":"internet","impact":"high","summary":"QNAP NAS devices running Photo Station have a path traversal flaw in which user-supplied file names are not restricted, so remote attackers can read or modify system files. CISA lists it as actively exploited in the wild, and the tags mark it as used in ransomware campaigns.","category":"infrastructure","who_cares":["qnap","nas","photo-station","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote attacker reads or modifies system files on the NAS","analyst_note":"Find the QNAP advisory for CVE-2019-7195 to get affected and fixed Photo Station versions and the exact check path; confirm whether authentication is required.","how_to_check":"Log in to the QNAP web admin and open App Center to see the installed Photo Station version; the affected and fixed versions are unknown from the sources.\nunknown","needs_analyst":true,"not_affected_if":["not-qnap","photo-station-not-installed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000514,"input_tokens":2827,"output_tokens":463,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2019':23A,26A '-7195':24A,27A 'access':17A,122C 'action':129C 'activ':88B 'allow':13A,118C 'appli':130C 'attack':15A,77B,120C 'campaign':102B 'cisa':84B,127C 'contain':108C 'control':6A,111C 'cve':22A,25A 'devic':56B,104C 'exploit':43B,89B 'extern':5A,110C 'file':8A,21A,70B,83B,113C,126C 'flaw':64B 'host':53B 'infrastructur':44B 'instruct':134C 'list':85B 'mark':96B 'modifi':19A,81B,124C 'name':9A,71B,114C 'nas':45B,55B 'path':11A,62B,116C 'per':132C 'photo':2A,29A,32A,35A,38A,41A,47B,58B,106C 'photo-st':46B 'qnap':1A,28A,31A,34A,37A,40A,49B,54B,103C 'ransomwar':50B,101B 'read':79B 'remot':14A,76B,119C 'requir':128C 'restrict':74B 'run':57B,105C 'self':52B 'self-host':51B 'station':3A,30A,33A,36A,39A,42A,48B,59B,107C 'suppli':69B 'system':20A,82B,125C 'tag':95B 'travers':63B 'updat':131C 'use':99B 'user':68B 'user-suppli':67B 'vendor':133C 'vulner':12A,117C 'wild':92B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-12-05T17:15:13+00:00","kev":{"dateAdded":"2022-06-08","dueDate":"2022-06-22","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-7195","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-7195","severity":null,"published_at":"2022-06-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T16:39:48+00:00","note":null},{"source":"epss","external_id":"CVE-2019-7195","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-7195","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-7195","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7195","severity":null,"published_at":"2019-12-05T17:15:13+00:00","modified_at":"2026-06-17T02:40:14+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}