QNAP Video Station CVE-2025-66272

Exploitation requires an authenticated QNAP NAS user account (CVSS PR:L) with access to the Video Station application, plus the vendor-indicated attack requirement (AT:P) - a specific condition or state that must be present for the traversal to succeed. The limiting factors are: a valid low-privilege login is mandatory (no unauthenticated access), the affected app (Video Station 5.8.x below 5.8.5) must be installed and enabled on the NAS, and the AT:P flag implies exploitation is not guaranteed under all configurations. Impact is confined to reading unexpected files or system data, not code execution.

This is a moderate-priority, authenticated information-disclosure flaw rather than a critical, widely-weaponizable issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N, base 7.7) indicates remote but authenticated exploitation (PR:L requires a valid user account) with an additional attack requirement (AT:P), which lowers real-world likelihood versus an unauthenticated flaw. Notably, the vendor's impact metrics claim VC:H/VI:H/VA:H (full confidentiality, integrity AND availability impact), yet the description describes only reading the contents of unexpected files or system data - a pure confidentiality issue for a CWE-22 path traversal; the VI:H and VA:H ratings appear inflated and should be treated with caution. No EPSS score, CISA KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The requirement for a pre-existing authenticated account materially limits the attacker population to insiders or those who have already compromised a low-privilege credential, making this a real but non-emergency patching priority.

An attacker who has obtained or been granted a low-privileged user account on a QNAP NAS running Video Station sends crafted requests containing directory-traversal sequences to a file-handling endpoint, causing the application to return files outside the intended media directories. This could expose configuration files, system data, or other users' content. No public proof-of-concept is known, and exploitation requires valid authentication plus the attack requirement (AT:P) the vendor flagged.