The vulnerability is a relative path traversal flaw that allows a remote attacker, once in possession of a user account, to read unexpected files or system data. An attacker could potentially exploit this to read sensitive configuration files or other privileged information, and the description notes a Root RCE possibility, indicating that further exploitation could lead to complete compromise of the system.

QNAP Systems Inc. Download Station is affected by versions older than 5.10.2.313 and 5.11.3.322. All installations of Download Station not updated to these specific release numbers are vulnerable.

The CVSS score of 8.7 reflects a high severity with significant impact. The EPSS score is below 1%, suggesting that widespread exploitation is not yet common, but the vulnerability remains exploitable by an attacker who can create or compromise a user account. As it is not listed in the CISA KEV catalog, there is no current evidence of active exploitation, yet the potential for Remote Code Execution remains significant if the flaw is leveraged.