The vulnerability is a path traversal flaw that allows a remote attacker who has a valid user account to read arbitrary files on the system. The flaw arises from improper validation of file paths, enabling the attacker to reference files outside the intended directory. The impact is the disclosure of sensitive or system data, which can compromise confidentiality and potentially aid further attacks.

QNAP Systems Inc. Video Station is affected by this issue. No specific affected version numbers are listed in the advisory; however, the vendor has indicated that versions prior to 5.8.5 are vulnerable and that the problem is resolved in Video Station 5.8.5 and later.

The CVSS score of 7.7 indicates a high severity, but the EPSS score of less than 1% reflects a very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is a network-based exploit limited to users who already possess a valid account on the Video Station. To exploit, an attacker manipulates file path inputs to access unintended files on the host.