CVE-2019-7194: QNAP Photo Station path traversal allows remote file access and modification

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCritical CVSS 9.8, unauthenticated network exploitation, KEV listing with known ransomware use, and very high EPSS probability make this an urgent patch.

What it is

CVE-2019-7194 is a path traversal (CWE-22) flaw in QNAP Photo Station that lets remote attackers control a file name or path and thereby access or modify system files. It carries a critical CVSS 3.1 score of 9.8 and is listed in CISA's Known Exploited Vulnerabilities catalog with known ransomware campaign use, so it is a high-value target for defenders.

Impact

An unauthenticated remote attacker can read or alter system files on the affected QNAP device, which can lead to data exposure, configuration tampering, or full compromise of the NAS.

Attack surface

The vulnerability is network-reachable (AV:N) with no privileges or user interaction required (PR:N, UI:N), so any host that can reach the Photo Station service can attempt it. No authentication is needed per the CVSS vector.

Exploitation

It is in CISA KEV (added 2022-06-08) with known ransomware campaign use, and EPSS shows a 30-day probability of 0.83124 (99.7th percentile). A public exploit reference exists (Packet Storm), indicating active exploitation is feasible and observed.

What to do

• Update QNAP Photo Station to the latest version per the vendor advisory (NAS-201911-25) as the first action.
• Apply the corresponding QTS firmware updates if the advisory requires them for the fix to take effect.
• Restrict network access to Photo Station and the NAS management interface to trusted hosts or VPN only.
• Disable or remove Photo Station if it is not required on the device.
• Monitor QNAP security advisories for follow-up patches and re-check the KEV due date compliance.

Detection

• Review web server and Photo Station logs for path traversal patterns such as ../ sequences or encoded variants in request URIs.
• Alert on unexpected file reads or writes to system paths outside the Photo Station web root.
• Monitor for known exploitation artifacts and post-exploitation behavior consistent with ransomware on QNAP NAS devices.
• Correlate network connections to Photo Station from untrusted sources with file access anomalies.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.