QNAP Download Station
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in QNAP Download Station.
By the Year
In 2026 there have been 3 vulnerabilities in QNAP Download Station with an average score of 7.5 out of ten. Last year, in 2025 Download Station had 2 security vulnerabilities published. That is, 1 more vulnerability have already been reported in 2026 as compared to last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 3 | 7.47 |
| 2025 | 2 | 0.00 |
| 2024 | 1 | 5.40 |
It may take a day or so for new Download Station vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent QNAP Download Station Security Vulnerabilities
SSRF in QNAP Download Station <5.10.1.312 & <5.11.2.321
CVE-2026-39989
5.3 - Medium
- October 15, 2026
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later
SSRF
Permission Escalation in QNAP Download Station before 5.11.2.321
CVE-2026-34014
8.4 - High
- October 15, 2026
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later
Incorrect Permission Assignment for Critical Resource
CVE-2026-39993: Path Traversal in QNAP Download Station <5.10.2.313 & <5.11.3.322
CVE-2026-39993
8.7 - High
- October 15, 2026
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Download Station 5.10.2.313 and later Download Station 5.11.3.322 and later
Relative Path Traversal
Path Traversal in Synology Download Station 5.10.0.304+
CVE-2025-58463
- November 07, 2025
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: Download Station 5.10.0.305 ( 2025/09/16 ) and later Download Station 5.10.0.304 ( 2025/09/08 ) and later
Relative Path Traversal
XSS in Download Station v<5.10.0.304> - remote account bypass
CVE-2025-58465
- November 07, 2025
A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: Download Station 5.10.0.305 ( 2025/09/16 ) and later Download Station 5.10.0.304 ( 2025/09/08 ) and later
XSS
Download Station 5.8.x XSS Enables Authenticated Network Code Injection
CVE-2024-38640
5.4 - Medium
- September 06, 2024
A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Download Station 5.8.6.283 ( 2024/06/21 ) and later
XSS
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for QNAP Download Station or by QNAP? Click the Watch button to subscribe.
