CVE-2026-24724: File Station 5

Synopsis

An incorrect authorization vulnerability affects QNAP File Station 5, reachable over the network by any authenticated user with a low-privilege account. The flaw allows an attacker who holds a valid user account to bypass access restrictions that are supposed to limit what files or directories they can reach, exposing file contents and allowing unauthorized writes. A patched-image rebuild at version 5.5.6.5243 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker exploits this remotely without requiring local or physical access to the host.

• AuthenticationRequired

  A valid user account is needed to exploit this vulnerability, though any low-privilege account is sufficient, not admin credentials.

• Victim interactionNot required

  No action from another user or victim is needed; the attacker operates entirely on their own once authenticated.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions, specific memory layouts, or environmental dependencies required to trigger the authorization bypass.

Blast Radius

• An attacker reads files and directories beyond the scope their account is authorized to access, including files belonging to other users.
• An attacker writes to or modifies files and directories they should not have permission to change, enabling data tampering or planting of malicious content.
• Confidentiality and integrity of stored data are both compromised, but the service itself remains available as there is no denial-of-service impact indicated by the CVSS scoring.
• The impact is confined to the File Station 5 component; no cross-system or downstream service compromise is indicated by the CVSS vector.