---
id: "CVE-2022-27593"
kind: "vulnerability"
aliases: ["CVE-2022-27593"]
title: "qnap photo station: An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo\u2026"
severity: "critical"
cvss: 10.0
epss: 0.87908
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "qnap photo station", "fixed": ["5.2.14"], "affected": "< 5.2.14", "ecosystem": "vendor"}, {"name": "qnap photo station", "fixed": ["5.4.15"], "affected": "< 5.4.15", "ecosystem": "vendor"}, {"name": "qnap photo station", "fixed": ["5.7.18"], "affected": "< 5.7.18", "ecosystem": "vendor"}, {"name": "qnap photo station", "fixed": ["6.0.22"], "affected": "< 6.0.22", "ecosystem": "vendor"}, {"name": "qnap photo station", "fixed": ["6.1.2"], "affected": "< 6.1.2", "ecosystem": "vendor"}, {"name": "QNAP Photo Station", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "nas", "photo-station", "qnap", "ransomware", "self-hosted"]
not_affected_if: ["no-internet-exposure", "photo-station-not-installed"]
published_at: "2022-09-08T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-24T00:09:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-27593", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-27593", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27593", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# qnap photo station: An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo…

QNAP Photo Station on certain QNAP NAS devices has an externally controlled reference flaw that lets an internet attacker modify system files. It has been used in Deadbolt ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:qnap photo station affected < 5.2.14 fixed 5.2.14
- vendor:qnap photo station affected < 5.4.15 fixed 5.4.15
- vendor:qnap photo station affected < 5.7.18 fixed 5.7.18
- vendor:qnap photo station affected < 6.0.22 fixed 6.0.22
- vendor:qnap photo station affected < 6.1.2 fixed 6.1.2
- vendor:QNAP Photo Station affected ? fixed ?

## Fix

Apply the QNAP update for Photo Station per vendor instructions; the sources do not name the fixed version.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-27593
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-27593
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-27593

## From the sources

An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_