CVE-2019-7194

CVE-2019-7194: QNAP Photo Station Path Traversal (CISA KEV)

AI-generated analysis based on the vulnerability data on this page.

Summary

CVE-2019-7194 is a path traversal vulnerability in QNAP Photo Station. The application fails to properly sanitize user-supplied file names or paths, allowing a remote attacker to traverse the directory structure and access or modify system files without authentication.

Background

QNAP Photo Station is a photo-management application bundled with QNAP Network-Attached Storage (NAS) devices running QTS. It enables users to upload, organize, and share photos. Because the service is typically exposed to the network for convenience, vulnerabilities in this component can have a broad impact on home and enterprise NAS deployments.

Root Cause

The vulnerability is classified as CWE-22: Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). The Photo Station application accepts user-controlled input for file names or paths without adequate validation or sanitization. Consequently, an attacker can supply path traversal sequences to escape the intended directory boundary and access files outside the web root or application sandbox.

Impact

This vulnerability received a CVSS 3.1 score of 9.8 (CRITICAL) and a CVSS 2.0 score of 7.5 (HIGH). The CVSS 3.1 vector indicates:

• Attack Vector (AV): Network — exploitable remotely
• Attack Complexity (AC): Low — no special conditions required
• Privileges Required (PR): None — unauthenticated exploitation
• User Interaction (UI): None — fully automated
• Scope (S): Unchanged
• Confidentiality (C): High — attacker can read sensitive files
• Integrity (I): High — attacker can modify system files
• Availability (A): High — potential for system disruption

The EPSS score of 0.82966 (99.63rd percentile) indicates a very high probability of observed exploitation in the wild. CISA has added this CVE to the Known Exploited Vulnerabilities catalog (added 2022-06-08).

Exploitation Walkthrough

From a defensive perspective, exploitation occurs when an attacker sends crafted HTTP requests to the Photo Station endpoint that include directory traversal sequences in file-name or path parameters. Because the application concatenates the attacker-controlled input into a filesystem path without filtering traversal sequences, the resulting path may resolve to sensitive locations such as system configuration files or password stores.

Ethics Note: This description is intentionally generic and is provided for defensive awareness only. Security professionals should test only on systems they own or have explicit permission to test.

Affected and Patched Versions

Affected products and versions (per CPE data):

• QNAP Photo Station — all versions (cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*)
• QNAP QTS — multiple versions including 4.2.6 and 4.4.1

QNAP has released security updates. Administrators should consult the official QNAP security advisory (NAS-201911-25) for the exact patched version numbers and upgrade instructions.

Remediation

1. Upgrade immediately. Apply the latest Photo Station and QTS firmware updates published by QNAP.
2. Restrict network exposure. Do not expose Photo Station directly to the internet; place it behind a VPN or restrict source IPs via firewall rules.
3. Segment your NAS. Isolate NAS devices on a dedicated network segment with limited ingress and egress traffic.
4. Disable unnecessary services. If Photo Station is not required, disable it entirely.

Detection

• Monitor web server logs for requests containing path traversal patterns (e.g., ../, encoded variants) targeting Photo Station endpoints.
• Correlate Photo Station access logs with file-system audit logs for unexpected reads outside the photo album directories.
• Check your QNAP NAS against the QNAP Security Advisory (NAS-201911-25) to confirm patch status.
• Query the CISA KEV catalog to verify this CVE is flagged in your vulnerability management program.

Assessment

CVE-2019-7194 is a critical, actively exploited path traversal vulnerability with an EPSS score above 80%, confirming widespread exploitation. The combination of network accessibility, low attack complexity, and no authentication requirement makes it an attractive target for opportunistic and targeted threat actors alike.

Key lessons:

1. Input validation is essential. Any endpoint that accepts file names or paths must strictly validate against traversal sequences.
2. Network exposure amplifies risk. NAS services intended for internal use should never be internet-facing without additional controls.

References

• QNAP Security Advisory NAS-201911-25
• CISA Known Exploited Vulnerabilities Catalog
• Packet Storm — QNAP QTS And Photo Station 6.0.3 Remote Command Execution