CVE-2025-66272: QNAP Video Station Path Traversal Flaw

CVE-2025-66272 Overview

CVE-2025-66272 is a path traversal vulnerability [CWE-22] affecting QNAP Video Station. An authenticated remote attacker can exploit improper path validation to read files outside the intended directory. Successful exploitation exposes system data and sensitive configuration files stored on the QNAP NAS device. QNAP has patched the issue in Video Station 5.8.5 and later.

Critical Impact
An authenticated remote attacker can read unexpected files or system data on the QNAP NAS, potentially exposing credentials, configuration, and sensitive user content.

Affected Products

QNAP Video Station versions prior to 5.8.5
QNAP NAS appliances running vulnerable Video Station builds
Deployments exposing Video Station to untrusted networks

Discovery Timeline

2026-10-15 - CVE-2025-66272 published to the National Vulnerability Database (NVD)
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2025-66272

Vulnerability Analysis

The vulnerability resides in QNAP Video Station, a media management application for QNAP network-attached storage (NAS) devices. The application fails to properly sanitize user-supplied path components before accessing files on disk. An attacker with a valid, low-privileged user account can submit crafted path parameters containing directory traversal sequences. The application then resolves those sequences and reads files outside the Video Station data directory.

Successful exploitation yields the contents of arbitrary files readable by the Video Station service account. Targets include system configuration files, application logs, and credential stores accessible to the service.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory, classified as [CWE-22]. Video Station accepts file path input without normalizing or validating that the resolved path remains within the intended base directory. Sequences such as ../ are passed through to filesystem APIs, enabling traversal outside the application sandbox.

Attack Vector

Exploitation requires network access to the Video Station web interface and valid user credentials. The attacker issues an HTTP request to a vulnerable Video Station endpoint and injects traversal sequences into a path parameter. The server resolves the path, opens the targeted file, and returns its contents in the HTTP response. No user interaction beyond the attacker's own session is required.

See the QNAP Video Station Pro Release Notes for vendor-supplied technical details and fix information.

Detection Methods for CVE-2025-66272

Indicators of Compromise

HTTP requests to Video Station endpoints containing ../, ..%2f, or URL-encoded traversal sequences in path or query parameters
Access log entries showing Video Station reading files outside its application directory, such as /etc/, /mnt/HDA_ROOT/, or user home directories
Unexpected read activity by the Video Station service account against configuration or credential files

Detection Strategies

Inspect QNAP web server access logs for Video Station URLs containing directory traversal patterns and encoded variants
Correlate authenticated Video Station sessions with filesystem access events touching paths outside /share/CACHEDEV*/
Alert on repeated 200-response reads of system files by Video Station session identifiers

Monitoring Recommendations

Forward QNAP system and web access logs to a centralized SIEM for traversal-pattern analysis
Baseline normal Video Station file access patterns and flag deviations touching system directories
Monitor authentication events for Video Station accounts and investigate accounts with unusual read volumes

How to Mitigate CVE-2025-66272

Immediate Actions Required

Upgrade QNAP Video Station to version 5.8.5 or later on all affected NAS devices
Restrict Video Station access to trusted networks and remove any direct internet exposure
Audit Video Station user accounts and remove unused or shared credentials
Rotate credentials and secrets that may have been accessible to the Video Station service account

Patch Information

QNAP has fixed the vulnerability in Video Station 5.8.5 and later. Administrators should install the update through the QNAP App Center or download it from the vendor. Refer to the QNAP Video Station Pro Release Notes for release details.

Workarounds

Disable Video Station through the QNAP App Center until the patch is applied
Place QNAP devices behind a VPN and block external access to Video Station web endpoints
Enforce strong, unique passwords and multi-factor authentication for all QNAP user accounts

bash

# Example: block external access to QNAP Video Station on the perimeter firewall
# Replace <NAS_IP> with the internal address of the QNAP device
iptables -I FORWARD -p tcp -d <NAS_IP> --dport 8080 -j DROP
iptables -I FORWARD -p tcp -d <NAS_IP> --dport 8081 -j DROP