CVE-2019-7194 QNAP Photo Station Path Traversal

Exploited in the wild Critical 9.8 Published 5 Dec 2019 Updated 21 Oct 2025

Remote attackers can access or modify system files via path traversal in QNAP Photo Station, requiring an upgrade to the latest version.

Exploited in the wild: Since 8 Jun 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-7194?

CVE-2019-7194 is a critical path traversal vulnerability in QNAP NAS devices running Photo Station, published on 5 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.

Weakness: CWE-22

Which versions are affected by CVE-2019-7194?

It affects 1 product.

Products include Qnap Photo Station.

How do I fix CVE-2019-7194?

No fix has been published for CVE-2019-7194 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 22 Jun 2022.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2019-7194 being exploited?

Yes. Attackers have exploited CVE-2019-7194 in the wild since at least 8 Jun 2022, including in ransomware campaigns.

Public exploit code: 1 Metasploit module and 1 Nuclei template.

Sources

Also known as GHSA-4wch-cg8h-vqc6.