Medium severity · published Nov 7, 2025
CVE-2025-58463
Download Station
4.9
CVSS
0.5%
EPSS
No
On KEV
Description
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following versions:
Download Station 5.10.0.305 ( 2025/09/16 ) and later
Download Station 5.10.0.304 ( 2025/09/08 ) and later
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DS
Download Station · QNAP Systems Inc.
5.10.x before 5.10.0.305 ( 2025/09/16 ); 5.10.x before 5.10.0.304 ( 2025/09/08 ) · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-58463
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-58463
Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-25-37
More from Download Station
8.7
CVE-2026-39993
Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter
8.4
CVE-2026-34014
ds-move-files.sh is writable and executed as root
5.4
CVE-2025-58465
Download Station
5.4
CVE-2024-38640
Download Station
5.3
CVE-2026-39989
SSRF in QNAP Download Station