Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2020-2504: If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.
CVE-2020-2504 · published 5 years ago
Summary
If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.
What to do
- Update qnap qes to version 2.1.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| qnap | qes |
< 2.1.1 2.1.1 cpe:2.3:a:qnap:qes:*:*:*:*:*:*:*:* |
Original advisory text
If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.
If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.
References
- https://www.qnap.com/zh-tw/security-advisory/qsa-20-17 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-20Improper Input Validation
CWE-22Path Traversal
CWE-73External Control of File Name or Path
CWE-284Improper Access Control
Timeline
Published24 Dec 2020
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2020-2504 · NVD
Track software like this
Free during beta