A path traversal flaw in the upload.php component of Video Station allows an attacker who has authenticated to a user account to read arbitrary files on the NAS. The weakness is classified as CWE-22 and represents a direct violation of directory boundaries during file handling.

QNAP Systems Inc. Video Station, any release prior to 5.8.8. Versions 5.8.8 and newer contain the vendor patch that removes the vulnerable file‑handling logic and resolves the traversal issue.

The CVSS score of 8.7 indicates a high risk due to substantial impact and reachable attack vector once authenticated. The EPSS score of less than 1 % shows that exploitation is presently uncommon, and the vulnerability is not yet catalogued in the CISA KEV list. Because the fault requires legitimate user credentials, an attacker must first gain access—directly attacking the device or obtaining credentials is therefore a prerequisite. Once authenticated, the traversal can be exercised from any network location that can reach the upload.php endpoint, making the vulnerability remotely exploitable after login.