Download Station CVE-2026-39993

Requires an authenticated Download Station user account on a QNAP NAS (CVSS PR:L); the attacker then supplies relative path traversal sequences to a file-access feature to escape the intended directory and read arbitrary files. Exploitation is limited by the need for valid credentials to the Download Station application and by network reachability to the NAS - risk is highest where the NAS web interface is internet-exposed and account provisioning is loose; no user interaction (UI:N) or special non-default configuration is indicated. Affected builds are Download Station 5.11.x below 5.11.3.322 and 5.10.x below 5.10.2.313.

This is a genuine but conditional priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation requiring only a low-privileged authenticated user account (PR:L), which materially limits mass exploitation versus a PR:N flaw. The vendor's 8.7 (High) rating is inflated by assigning VI:H and VA:H, yet the description describes only reading 'the contents of unexpected files or system data' - a confidentiality impact. This is a notable conflict: a relative path traversal (CWE-23) read primitive does not obviously grant integrity or availability impact, so the VI:H/VA:H metrics should be verified with QNAP; my independent assessment treats this as primarily confidentiality (see assessed vector). No EPSS score, KEV listing, or POC was provided; therefore there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a real, patch-now issue for exposed QNAP NAS deployments because any low-privileged account can read sensitive files, but it is not a wormable unauthenticated RCE and current signals do not indicate in-the-wild use.

An attacker who has obtained or been granted a low-privileged Download Station user account on an internet-exposed QNAP NAS sends a request containing relative path traversal sequences (e.g. ../) to a file-handling endpoint, causing the application to read files outside the intended directory. This lets them retrieve sensitive system data such as configuration files or credentials. No public exploit code was identified at time of analysis.