CVE-2025-66275 Overview
CVE-2025-66275 is a path traversal vulnerability [CWE-22] affecting QNAP Video Station. An authenticated remote attacker with a valid user account can exploit improper path validation to read files outside the application's intended directory scope. The flaw allows disclosure of unexpected files and system data stored on the NAS device. QNAP has resolved the issue in Video Station 5.8.5 and later releases.
Critical Impact
Authenticated attackers can traverse the file system to read arbitrary files and sensitive system data on affected QNAP NAS appliances running vulnerable Video Station versions.
Affected Products
- QNAP Video Station versions prior to 5.8.5
- QNAP NAS appliances with Video Station installed
- Systems exposing Video Station over the network to authenticated users
Discovery Timeline
- 2026-10-15 - CVE-2025-66275 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2025-66275
Vulnerability Analysis
The vulnerability resides in Video Station's handling of file path parameters supplied through its web-facing interfaces. The application fails to normalize and validate user-controlled path input before resolving files on disk. An authenticated user can submit crafted path sequences to escape the application's intended directory boundaries. This grants read access to files and system data outside the Video Station content scope.
Exploitation requires low privileges (PR:L) and no user interaction. The attack is remotely reachable over the network wherever Video Station is accessible. Successful exploitation impacts confidentiality, integrity, and availability of data the Video Station process can read on the NAS file system.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory, classified as [CWE-22]. Video Station accepts path components without rejecting traversal sequences such as ../ or absolute path references. Because the application resolves these inputs against privileged file system locations, requests can reference arbitrary files reachable by the service account.
Attack Vector
The attacker must first obtain a valid Video Station user account on the target NAS. With network access to the Video Station endpoint, the attacker issues requests containing manipulated path parameters. The server returns file contents from locations outside the intended media directories, including configuration data and system files accessible to the service.
No public proof-of-concept or exploit code is listed for CVE-2025-66275 at this time. Refer to the QNAP Video Station Pro Release Notes for vendor technical details.
Detection Methods for CVE-2025-66275
Indicators of Compromise
- HTTP requests to Video Station endpoints containing path traversal sequences such as ../, encoded variants like %2e%2e%2f, or absolute paths referencing /etc/ or configuration directories.
- Unusual file access patterns in NAS audit logs where the Video Station service reads files outside its media library paths.
- Authentication events from low-privilege Video Station accounts followed by rapid, repeated file retrieval requests.
Detection Strategies
- Inspect reverse proxy and NAS web server logs for Video Station URL parameters containing directory traversal patterns or encoded path separators.
- Correlate successful Video Station authentications with abnormal request volume or diverse file paths requested per session.
- Deploy web application firewall rules that flag path traversal signatures on Video Station application routes.
Monitoring Recommendations
- Enable detailed access logging on the QNAP NAS and forward logs to a centralized analytics platform for retention and search.
- Monitor the Video Station application version across the fleet to confirm all instances report 5.8.5 or later.
- Alert on Video Station account creation, privilege changes, and failed login spikes that could precede exploitation attempts.
How to Mitigate CVE-2025-66275
Immediate Actions Required
- Update Video Station to version 5.8.5 or later on every affected QNAP NAS appliance.
- Audit existing Video Station user accounts and remove unused or unknown accounts that could serve as an exploitation foothold.
- Restrict Video Station exposure to trusted networks and disable remote access from the public internet where feasible.
Patch Information
QNAP has released Video Station 5.8.5 as the fixed version. Administrators should install the patched release through the QNAP App Center on each affected device. Verify the installed version after update by checking the App Center or the application details pane. See the QNAP Video Station Pro Release Notes for release details.
Workarounds
- Temporarily disable Video Station through the QNAP App Center until the update to 5.8.5 can be applied.
- Enforce strong password policies and two-step verification on all NAS accounts to reduce the risk of account takeover required for exploitation.
- Place the NAS behind a VPN or firewall that restricts Video Station access to authenticated administrative networks only.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
