Download Station

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:qnap_systems_inc.:download_station:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorQnap Systems Inc. (1f66ac1e-0889-51bf-b27f-24c7175e5920)
ProductDownload Station (31681e8e-cef2-55fa-8c4b-79c415840477)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-34014 vulnerable 2026-11-03 10:17:22.191642 ds-move-files.sh is writable and executed as root
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later
Published: 2026-10-15T09:30:12.174Z
Updated: 2026-10-15T13:39:02.703Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-39993 vulnerable 2026-11-03 10:15:55.217771 Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Download Station 5.10.2.313 and later Download Station 5.11.3.322 and later
Published: 2026-10-15T07:00:00.379Z
Updated: 2026-10-15T14:48:37.464Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-39989 vulnerable 2026-11-03 10:15:54.861645 SSRF in QNAP Download Station
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later
Published: 2026-10-15T09:30:42.076Z
Updated: 2026-10-15T13:43:27.205Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-58465 vulnerable 2026-06-08 07:35:18.340128 Download Station
A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: Download Station 5.10.0.305 ( 2025/09/16 ) and later Download Station 5.10.0.304 ( 2025/09/08 ) and later
Published: 2025-11-07T15:09:31.301Z
Updated: 2025-11-07T15:47:03.235Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-58463 vulnerable 2026-06-08 07:35:18.323932 Download Station
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: Download Station 5.10.0.305 ( 2025/09/16 ) and later Download Station 5.10.0.304 ( 2025/09/08 ) and later
Published: 2025-11-07T15:10:42.856Z
Updated: 2025-11-07T16:11:30.915Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-38640 vulnerable 2026-06-08 06:41:47.809705 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.