---
id: "CVE-2019-7195"
kind: "vulnerability"
aliases: ["CVE-2019-7195"]
title: "qnap photo station: This external control of file name or path vulnerability allows remote attackers to access or modify system files"
severity: "critical"
cvss: 9.8
epss: 0.89681
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "qnap photo station", "fixed": ["6.0.3"], "affected": "< 6.0.3", "ecosystem": "vendor"}, {"name": "qnap photo station", "fixed": ["5.7.10"], "affected": "< 5.7.10", "ecosystem": "vendor"}, {"name": "qnap photo station", "fixed": ["5.4.9"], "affected": "< 5.4.9", "ecosystem": "vendor"}, {"name": "qnap photo station", "fixed": ["5.2.11"], "affected": "< 5.2.11", "ecosystem": "vendor"}, {"name": "QNAP Photo Station", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "nas", "photo-station", "qnap", "ransomware", "self-hosted"]
not_affected_if: ["not-qnap", "photo-station-not-installed"]
published_at: "2019-12-05T17:15:13+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-24T00:09:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-7195", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-7195", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7195", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# qnap photo station: This external control of file name or path vulnerability allows remote attackers to access or modify system files

QNAP NAS devices running Photo Station have a path traversal flaw in which user-supplied file names are not restricted, so remote attackers can read or modify system files. CISA lists it as actively exploited in the wild, and the tags mark it as used in ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:qnap photo station affected < 6.0.3 fixed 6.0.3
- vendor:qnap photo station affected < 5.7.10 fixed 5.7.10
- vendor:qnap photo station affected < 5.4.9 fixed 5.4.9
- vendor:qnap photo station affected < 5.2.11 fixed 5.2.11
- vendor:QNAP Photo Station affected ? fixed ?

## How to check

Log in to the QNAP web admin and open App Center to see the installed Photo Station version; the affected and fixed versions are unknown from the sources.

## Fix

Update Photo Station and QNAP firmware to the vendor's fixed release per QNAP's advisory; the exact version is unknown from the sources.
Restrict NAS admin and Photo Station access from the internet until patched.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-7195
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-7195
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-7195

## From the sources

QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_