All vulnerabilities
CVE-2026-34014

Download Station: ds-move-files.sh is writable and executed as root

QNAP Systems Inc. Download Station
Open in ThreatlineRecord JSON
CVSS
8.4High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.13%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.10.1.312Also 5.11.2.321CVE List
Published15 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later

Text from CVE List

Affected versions 2

  • Download Stationaffected: 5.10.x before 5.10.1.312CVE List
  • Download Stationaffected: 5.11.x before 5.11.2.321CVE List

References 1