CVE-2018-0722 Path traversal in Photo Station

What is CVE-2018-0722?

CVE-2018-0722 is a high-severity path traversal vulnerability in QNAP Photo Station, published on 1 Feb 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6 could allow remote attackers to access sensitive information on the device.

Weakness: CWE-22

Which versions are affected by CVE-2018-0722?

It affects 1 product.

Products include Qnap Photo Station.

How do I fix CVE-2018-0722?

No fix has been published for CVE-2018-0722 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2018-0722 being exploited?

There is no known exploitation of CVE-2018-0722 in the wild and no public exploit code.

Other vulnerabilities in QNAP Photo Station

• CVE-2022-27593 QNAP Photo Station Externally Controlled Reference Exploited Critical 10.0
• CVE-2019-7192 QNAP Photo Station Improper Access Control Exploited Critical 9.8
• CVE-2019-7194 QNAP Photo Station Path Traversal Exploited Critical 9.8
• CVE-2019-7195 QNAP Photo Station Path Traversal Exploited Critical 9.8
• CVE-2017-20210 Photo Station Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r7gm-6ww8-qrxr.