CVE-2019-7194

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.

Affected

QNAP NAS devices running Photo Station

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

82.71% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2022-06-08, used in ransomware campaigns

Nuclei

critical · CWE-22

Published

2019-12-05

Updated

2025-10-21

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Comma…

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7194.yaml

Security advisories

• https://www.qnap.com/zh-tw/security-advisory/nas-201911-25

References

• CVE Record
• NVD entry