CVE-2026-39993: Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter

Q: What access does an attacker need to exploit this issue?

The attacker must first obtain a user account. The reported issue is exploitable remotely after authenticated access is gained.

Q: Which Download Station releases contain the fix?

The vulnerability is fixed in Download Station 5.10.2.313 and later, and in Download Station 5.11.3.322 and later.

Q: What could a successful exploit expose?

A successful exploit may allow an authenticated remote attacker to read unexpected files or system data through relative path traversal.

Published Oct 15, 2026

Updated

A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version: Download Station 5.10.2.313 and later Download Station 5.11.3.322 and later

Affected Software

1 affected component

QNAP Download Station<5.10.2.313, <5.11.3.322

Event History

Oct 15, 2026

CVE Published

via MITRE·07:00 AM

Data Sourced

via MITRE·07:00 AM

RemedyDescriptionWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must first obtain a user account. The reported issue is exploitable remotely after authenticated access is gained.

Which Download Station releases contain the fix?

The vulnerability is fixed in Download Station 5.10.2.313 and later, and in Download Station 5.11.3.322 and later.

What could a successful exploit expose?

A successful exploit may allow an authenticated remote attacker to read unexpected files or system data through relative path traversal.