CVE-2026-39993: Path Traversal in QNAP Download Station <5.10.2.313 & <5.11.3.322
CVE-2026-39993 Published on October 15, 2026
Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Download Station 5.10.2.313 and later
Download Station 5.11.3.322 and later
Vulnerability Analysis
CVE-2026-39993 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Relative Path Traversal
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
Products Associated with CVE-2026-39993
Want to know whenever a new CVE is published for QNAP Download Station? stack.watch will email you.
Affected Versions
QNAP Systems Inc. Download Station:- Version 5.10.x and below 5.10.2.313 is affected.
- Version 5.11.x and below 5.11.3.322 is affected.