A path‑traversal flaw in QNAP File Station 5 permits a remote attacker who has obtained a valid user account to read files that should not be accessible, exposing system data to disclosure. The weakness stems from inadequate validation of user‑supplied file paths, a classic CWE‑22 scenario. The impact is the potential compromise of confidentiality for any files the attacker can traverse to, such as configuration or sensitive documents, without affecting integrity or availability directly.

Versions of QNAP File Station 5 earlier than 5.5.6.5190 are affected. Hardware running this firmware is vulnerable until an upgrade to 5.5.6.5190 or later is applied.

The CVSS score of 1.3 reflects the low impact and the requirement that the attacker must already have legitimate user credentials or a compromised account. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not reported as a known exploited threat in CISA’s KEV catalog. The attack would involve authenticating to the system first and then manipulating file paths to read unintended files, a process that does not require additional privileges beyond those granted to the user account.