Skip to main content

Photo Station CVE-2019-11822

MEDIUM
Relative Path Traversal (CWE-23)
2019-06-30 security@synology.com
Path Traversal Synology Photo Station
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

1
CVE Published
Jun 30, 2019 - 15:15 nvd
MEDIUM 6.5

DescriptionNVD

Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to upload arbitrary files via the uploadphoto parameter.

AnalysisAI

Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to upload arbitrary files via the uploadphoto. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-23. Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to upload arbitrary files via the uploadphoto parameter. Affected products include: Synology Photo Station. Version information: before 6.8.11.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Photo Station

View all
CVE-2017-11155 HIGH POC
7.5 Aug 08

An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remot
CVE-2017-11153 CRITICAL POC
9.8 Aug 08

Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allo
CVE-2017-11151 CRITICAL POC
9.8 Aug 08

A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers
CVE-2016-10329 CRITICAL POC
9.8 May 12

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to exec
CVE-2017-11152 HIGH POC
7.5 Aug 08

Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 all
CVE-2019-7195 CRITICAL POC
9.8 Dec 05

This external control of file name or path vulnerability allows remote attackers to access or modify system files. Rated
CVE-2019-7194 CRITICAL POC
9.8 Dec 05

This external control of file name or path vulnerability allows remote attackers to access or modify system files. Rated
CVE-2019-7192 CRITICAL POC
9.8 Dec 05

This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. Rated crit
CVE-2016-10322 HIGH POC
8.8 Apr 10

Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell m
CVE-2022-27593 CRITICAL POC
9.1 Sep 08

An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Statio
CVE-2017-11154 HIGH POC
7.2 Aug 08

Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-296
CVE-2016-10323 HIGH POC
7.8 Apr 10

Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a "synoph

Same weakness CWE-23 – Relative Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2024-27199 HIGH POC
7.3
CVE-2025-34510 HIGH POC
8.8
CVE-2026-34926 MEDIUM POC
6.7
CVE-2024-24578 CRITICAL POC
9.8
CVE-2025-52207 CRITICAL POC
9.9
CVE-2023-6825 CRITICAL POC
9.9
CVE-2022-1373 HIGH POC
7.2

Same technique Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2015-0016 HIGH POC
7.8
CVE-2016-0752 HIGH POC
7.5
CVE-2024-13159 CRITICAL POC
9.8
CVE-2024-13160 CRITICAL POC
9.8
CVE-2024-13161 CRITICAL POC
9.8
CVE-2014-0780 CRITICAL POC
9.8
CVE-2024-48248 HIGH POC
8.6

Share

CVE-2019-11822 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy