A server-side request forgery flaw in QNAP Download Station allows a remote attacker who has compromised a user account to instruct the device to request internal URLs, potentially exposing application data. The vulnerability does not provide arbitrary code execution or denial of service, but it can lead to confidential information leakage.

QNAP Systems Inc.’s Download Station application is affected in versions prior to 5.10.1.312 and 5.11.2.321. Any device running an older version of these releases remains vulnerable until patched to the specified newer revisions.

The CVSS score of 5.3 rates this as a moderate severity flaw, and the EPSS score of less than 1% indicates a very low probability of exploitation at the time of this analysis. Although it has not been reported in CISA’s KEV catalog, the attack requires the attacker to first gain a valid user account, after which the SSRF can be leveraged to read sensitive data. The overall risk is therefore moderate to low, contingent on the presence of user credentials and internal network exposure.