CVE-2025-58463: QNAP Download Station Path Traversal Flaw

CVE-2025-58463 Overview

CVE-2025-58463 is a relative path traversal vulnerability affecting QNAP Download Station. An authenticated remote attacker with an administrator account can exploit the flaw to read the contents of files or system data outside the application's intended scope. The issue is classified under CWE-23: Relative Path Traversal.

QNAP has released fixes in Download Station 5.10.0.305 (2025/09/16) and Download Station 5.10.0.304 (2025/09/08) and later. The vulnerability affects Download Station deployments running on QTS and QuTS hero operating systems.

Critical Impact
Authenticated administrator-level attackers can traverse the file system to read unexpected files and system data on QNAP NAS appliances running vulnerable Download Station versions.

Affected Products

QNAP Download Station versions prior to 5.10.0.304 and 5.10.0.305
QNAP QTS (running affected Download Station application)
QNAP QuTS hero (running affected Download Station application)

Discovery Timeline

2025-11-07 - CVE-2025-58463 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58463

Vulnerability Analysis

The vulnerability is a relative path traversal weakness in the Download Station application on QNAP NAS devices. Download Station is an add-on that manages HTTP, FTP, BitTorrent, and other download tasks on QTS and QuTS hero systems.

Exploitation requires an authenticated session with administrator privileges. Once authenticated, an attacker can supply crafted path input containing traversal sequences such as ../ to reference files outside the directories that Download Station is expected to access. The application resolves the tainted path without adequate normalization or containment, returning file contents to the attacker.

Because Download Station typically runs with elevated privileges on the NAS, the traversal can yield access to system configuration files or data belonging to other services on the appliance. The attack is scoped to information disclosure; the advisory does not indicate direct write or code execution impact.

Root Cause

The root cause is insufficient validation of user-supplied path components. The application fails to canonicalize input and enforce a strict allowlist of accessible directories before opening files. This maps to CWE-23: Relative Path Traversal.

Attack Vector

The attack vector is network-based against the Download Station web interface. The attacker must first obtain administrator credentials, whether through credential reuse, phishing, brute force against exposed NAS management, or compromise of a legitimate admin session. With those credentials, the attacker issues requests containing path traversal payloads to Download Station endpoints that accept file or path parameters.

No verified proof-of-concept code has been published. QNAP has not disclosed the specific endpoint or parameter affected in the public advisory. See the QNAP Security Advisory QSA-25-37 for vendor detail.

Detection Methods for CVE-2025-58463

Indicators of Compromise

Download Station HTTP request logs containing ../, ..\, URL-encoded %2e%2e%2f, or double-encoded traversal sequences in path or filename parameters.
Unexpected file reads by the Download Station service process against paths outside /share/Download/ or the configured download destinations.
Administrator sessions originating from unusual IP addresses or user agents immediately followed by high-volume file-access activity.

Detection Strategies

Inspect QNAP system logs and Download Station access logs for anomalous request URIs targeting file, torrent, or task management endpoints with encoded traversal patterns.
Correlate administrator authentication events with subsequent file access outside standard download directories to identify post-authentication abuse.
Deploy endpoint or network monitoring that alerts on Download Station process activity reading sensitive files such as /etc/shadow, /etc/config/, or user home directories.

Monitoring Recommendations

Enable and centralize QTS/QuTS hero event and connection logs, and forward them to a SIEM for retention and correlation.
Alert on failed and successful administrator logins to the QNAP web UI, especially from external networks.
Track Download Station version strings across the fleet to identify unpatched appliances.

How to Mitigate CVE-2025-58463

Immediate Actions Required

Upgrade Download Station to version 5.10.0.305 (released 2025/09/16) or 5.10.0.304 (released 2025/09/08), or later, on all affected QNAP appliances.
Rotate administrator credentials on QNAP NAS devices and enforce multi-factor authentication for the admin account.
Restrict administrative access to the QNAP web interface to trusted management networks and remove any exposure to the public internet.

Patch Information

QNAP fixed CVE-2025-58463 in Download Station 5.10.0.305 (2025/09/16) and Download Station 5.10.0.304 (2025/09/08) and later. Apply the update through the QTS or QuTS hero App Center. Full remediation guidance is available in QNAP Security Advisory QSA-25-37.

Workarounds

Disable or uninstall the Download Station application on NAS devices that do not require it until the patched version is deployed.
Limit which local accounts hold administrator privileges on the NAS, and remove unused administrator accounts.
Block external access to the Download Station and QNAP admin ports at the perimeter firewall, permitting only VPN-based management.

bash

# Configuration example: restrict QNAP admin interface access with iptables
# Allow only an internal management subnet to reach the QNAP web UI (ports 8080/443)
iptables -A INPUT -p tcp -s 10.10.20.0/24 --dport 8080 -j ACCEPT
iptables -A INPUT -p tcp -s 10.10.20.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP