A path traversal flaw in QNAP Video Station allows a remote attacker who has an authenticated user account to read any file on the NAS that is not normally visible to that role, and based on the title can also delete files or execute code by dropping crafted scripts. The vulnerability is classified as CWE-22, a classic directory traversal issue that can lead to data exfiltration or full system compromise if the attacker can subsequently run code in the context of the Video Station service. Although the description only mentions file reading and the CVE title hints at deletion and execution, the potential impact is significant for users with privileged access.

The vulnerability affects QNAP Systems Inc.'s Video Station NAS application. All releases of Video Station older than version 5.8.5 are vulnerable; production systems running any earlier version are at risk. The fix begins with Video Station 5.8.5 and later, which removes the traversal logic that allowed unauthorized file access.

The CVSS score of 7.7 classifies this as high severity, while the EPSS score of less than 1% indicates a low current exploitation probability, and it is not yet listed in CISA’s KEV catalog. The attack vector requires remote, authenticated access to the Video Station interface; an attacker with login credentials can navigate the traversal path and exploit the flaw, but does not need privileged system rights. Even with the low EPSS, the potential for data loss or remote code execution warrants urgent remediation.