The vulnerability is an improper link resolution before file access in the VM import feature of Virtualization Station. An attacker who has authenticated with a user account can manipulate file paths during import, allowing the reading or overwriting of arbitrary files on the host. This flaw can disclose sensitive data or enable further exploitation that may facilitate privilege escalation. The weakness matches CWE-59.

Affected is QNAP Systems Inc. Virtualization Station for users running versions prior to 4.1.1.130. The flaw appears in the VM import process and affects all installations that have not yet applied the update.

The CVSS score of 8.7 indicates high severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The flaw is not listed in CISA KEV, so no widespread exploitation is documented. Based on the description, the likely attack vector is remote but requires authentication; from that position, path traversal can read or modify files, potentially leading to privilege escalation.