CVE-2026-39989: SSRF in QNAP Download Station
Published Oct 15, 2026
·Updated
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data.
We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later
Affected Software
1 affected component
QNAP Download Station<5.10.1.312, <5.11.2.321
Event History
Oct 15, 2026
CVE Published
via MITRE·09:30 AM
Data Sourced
via MITRE·09:30 AM
RemedyDescriptionWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker must first obtain a user account on the affected QNAP Download Station instance. The provided information describes exploitation by a remote attacker with authenticated user access.
2
What can a successful exploit expose?
A successful exploit can allow the attacker to read application data.
3
Which versions contain the fix?
The vulnerability is fixed in Download Station 5.10.1.312 and later, and Download Station 5.11.2.321 and later.