CVE-2025-66275: Remote code execution via command injection
Published Oct 15, 2026
·Updated
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later
Affected Software
1 affected component
Synology Video Station<5.8.5
Event History
Oct 15, 2026
CVE Published
via MITRE·06:58 AM
Data Sourced
via MITRE·06:58 AM
RemedyDescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A remote attacker must first obtain a user account. The reported impact is unauthorized reading of unexpected files or system data.
2
Which versions are affected?
Video Station versions earlier than 5.8.5 are affected. The issue is fixed in Video Station 5.8.5 and later.