ACTIVELY EXPLOITED
CVE-2019-7195: QNAP Photo Station Path Traversal Vulnerability
| Vendor | QNAP |
|---|---|
| Product | Photo Station |
| Actively exploited | Yes |
| Added to CISA KEV | 8 Jun 2022 |
| CISA federal deadline | 22 Jun 2022 |
| Ransomware use | Known |
| Weakness (CWE) | CWE-22 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
SOURCES
Other QNAP flaws
- CVE-2023-47565: QNAP VioStor NVR OS Command Injection Vulnerability
- CVE-2022-27593: QNAP Photo Station Externally Controlled Reference Vulnerability
- CVE-2019-7194: QNAP Photo Station Path Traversal Vulnerability
- CVE-2019-7193: QNAP QTS Improper Input Validation Vulnerability
- CVE-2019-7192: QNAP Photo Station Improper Access Control Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.