CVE-2019-7195: QNAP Photo Station path traversal allows remote file access and modification

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCritical CVSS 9.8, CISA KEV listing with known ransomware use, and very high EPSS probability make this an urgent patch-first issue.

What it is

CVE-2019-7195 is a path traversal (CWE-22) flaw in QNAP Photo Station that lets remote attackers access or modify system files. It carries a critical CVSS 3.1 score of 9.8 and is listed in CISA's Known Exploited Vulnerabilities catalog with known ransomware campaign use, so it is a high-value target for defenders.

Impact

An unauthenticated remote attacker can read and write system files on the affected QNAP device, which can lead to data exposure, configuration tampering, or full compromise. Public exploit code and ransomware use indicate real-world impact beyond theoretical file access.

Attack surface

The vulnerability is network-reachable (AV:N) with no privileges or user interaction required (PR:N, UI:N), so any exposed Photo Station instance is directly attackable. No authentication is needed to reach the vulnerable path handling.

Exploitation

It is in CISA KEV (added 2022-06-08) with known ransomware campaign use, and EPSS shows a 0.89681 30-day probability (99.78th percentile). A public exploit reference exists, confirming active exploitation.

What to do

• Update QNAP Photo Station to the latest version per the vendor advisory (NAS-201911-25).
• Apply the QNAP QTS updates referenced in the same advisory, since the exploit chain also involves QTS.
• Remove or restrict internet exposure of Photo Station and QNAP management interfaces until patched.
• Enforce network segmentation and firewall rules so only trusted hosts can reach NAS web services.
• Monitor QNAP security advisories and CISA KEV for follow-up guidance and re-check for new patches.

Detection

• Review Photo Station and QNAP web access logs for path traversal patterns such as ../ sequences or encoded variants in request URIs.
• Alert on unexpected file writes or reads in system directories by the Photo Station process.
• Hunt for known exploit artifacts or webshell drops on QNAP NAS devices, especially following suspicious Photo Station requests.
• Correlate NAS outbound connections or new admin accounts with Photo Station access events to catch post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.