# QNAP File Station vulnerabilities Source: https://junglewise.ai/threats/technologies/file-station Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/file-station.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 14 vulnerabilities in QNAP File Station: 0 in the last 7 days and 3 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-24723, was published on 15 October 2026. 3 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 3 - All time: 14 (0 critical, 0 exploited in the wild) ## About QNAP File Station A web-based file management tool for QNAP NAS devices that allows users to upload, download, and manage files. ## Latest QNAP File Station vulnerabilities - [CVE-2026-24723: QNAP File Station 5 NULL pointer dereference](https://junglewise.ai/threats/cve-2026-24723-a-null-pointer-dereference-vulnerability-has-been-reported-to) (medium, CVSS 6.5, published 15 Oct 2026) - [CVE-2026-24722: QNAP File Station 5 NULL pointer dereference](https://junglewise.ai/threats/cve-2026-24722-a-null-pointer-dereference-vulnerability-has-been-reported-to) (medium, CVSS 6.5, published 15 Oct 2026) - [CVE-2026-24721: QNAP File Station 5 NULL pointer dereference](https://junglewise.ai/threats/cve-2026-24721-a-null-pointer-dereference-vulnerability-has-been-reported-to) (medium, CVSS 6.5, published 15 Oct 2026) - [CVE-2026-24720: QNAP File Station resource exhaustion vulnerability](https://junglewise.ai/threats/cve-2026-24720-qnap-file-station-resource-exhaustion-vulnerability) (info, CVSS 5.3, published 10 Jun 2026) - [CVE-2026-22899: QNAP File Station NULL pointer dereference in File Station 6](https://junglewise.ai/threats/cve-2026-22899-qnap-file-station-null-pointer-dereference-in-file-station-6) (info, CVSS 5.3, published 10 Jun 2026) - [CVE-2025-57706: A cross-site scripting (XSS) vulnerability has been reported to affect File Station 5. If a remote attacker gains a…](https://junglewise.ai/threats/cve-2025-57706-a-cross-site-scripting-xss-vulnerability-has-been-reported-to) (medium, CVSS 5.4, published 7 Nov 2025) - [CVE-2025-53413: An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a…](https://junglewise.ai/threats/cve-2025-53413-an-allocation-of-resources-without-limits-or-throttling) (medium, CVSS 6.5, published 7 Nov 2025) - [CVE-2025-53412: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user…](https://junglewise.ai/threats/cve-2025-53412-a-null-pointer-dereference-vulnerability-has-been-reported-to) (medium, CVSS 6.5, published 7 Nov 2025) - [CVE-2025-53411: An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a…](https://junglewise.ai/threats/cve-2025-53411-an-allocation-of-resources-without-limits-or-throttling) (medium, CVSS 4.9, published 7 Nov 2025) - [CVE-2025-53410: An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a…](https://junglewise.ai/threats/cve-2025-53410-an-allocation-of-resources-without-limits-or-throttling) (medium, CVSS 6.5, published 7 Nov 2025) - [CVE-2025-53409: An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a…](https://junglewise.ai/threats/cve-2025-53409-an-allocation-of-resources-without-limits-or-throttling) (medium, CVSS 6.5, published 7 Nov 2025) - [CVE-2025-53408: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user…](https://junglewise.ai/threats/cve-2025-53408-a-null-pointer-dereference-vulnerability-has-been-reported-to) (medium, CVSS 6.5, published 7 Nov 2025) - [CVE-2025-52865: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user…](https://junglewise.ai/threats/cve-2025-52865-a-null-pointer-dereference-vulnerability-has-been-reported-to) (medium, CVSS 6.5, published 7 Nov 2025) - [CVE-2025-47207: A NULL pointer dereference vulnerability has been reported to affect several product versions. If a remote attacker…](https://junglewise.ai/threats/cve-2025-47207-a-null-pointer-dereference-vulnerability-has-been-reported-to) (medium, CVSS 6.5, published 7 Nov 2025) ## Most severe QNAP File Station vulnerabilities - [CVE-2025-53413: An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a…](https://junglewise.ai/threats/cve-2025-53413-an-allocation-of-resources-without-limits-or-throttling) (medium, CVSS 6.5, published 7 Nov 2025) - [CVE-2025-53412: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user…](https://junglewise.ai/threats/cve-2025-53412-a-null-pointer-dereference-vulnerability-has-been-reported-to) (medium, CVSS 6.5, published 7 Nov 2025) - [CVE-2025-53410: An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a…](https://junglewise.ai/threats/cve-2025-53410-an-allocation-of-resources-without-limits-or-throttling) (medium, CVSS 6.5, published 7 Nov 2025) - [CVE-2025-53409: An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a…](https://junglewise.ai/threats/cve-2025-53409-an-allocation-of-resources-without-limits-or-throttling) (medium, CVSS 6.5, published 7 Nov 2025) - [CVE-2025-53408: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user…](https://junglewise.ai/threats/cve-2025-53408-a-null-pointer-dereference-vulnerability-has-been-reported-to) (medium, CVSS 6.5, published 7 Nov 2025) - [CVE-2025-52865: A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user…](https://junglewise.ai/threats/cve-2025-52865-a-null-pointer-dereference-vulnerability-has-been-reported-to) (medium, CVSS 6.5, published 7 Nov 2025) - [CVE-2025-47207: A NULL pointer dereference vulnerability has been reported to affect several product versions. If a remote attacker…](https://junglewise.ai/threats/cve-2025-47207-a-null-pointer-dereference-vulnerability-has-been-reported-to) (medium, CVSS 6.5, published 7 Nov 2025) - [CVE-2026-24723: QNAP File Station 5 NULL pointer dereference](https://junglewise.ai/threats/cve-2026-24723-a-null-pointer-dereference-vulnerability-has-been-reported-to) (medium, CVSS 6.5, published 15 Oct 2026) - [CVE-2026-24722: QNAP File Station 5 NULL pointer dereference](https://junglewise.ai/threats/cve-2026-24722-a-null-pointer-dereference-vulnerability-has-been-reported-to) (medium, CVSS 6.5, published 15 Oct 2026) - [CVE-2026-24721: QNAP File Station 5 NULL pointer dereference](https://junglewise.ai/threats/cve-2026-24721-a-null-pointer-dereference-vulnerability-has-been-reported-to) (medium, CVSS 6.5, published 15 Oct 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 3 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other QNAP technologies - [QNAP QTS](https://junglewise.ai/threats/technologies/qts): 37 vulnerabilities - [QNAP Quts Hero](https://junglewise.ai/threats/technologies/qnap-quts-hero): 24 vulnerabilities - [QNAP Video Station](https://junglewise.ai/threats/technologies/video-station): 6 vulnerabilities - [QNAP Network Attached Storage (NAS)](https://junglewise.ai/threats/technologies/network-attached-storage-nas): 5 vulnerabilities - [QNAP Hybrid Backup Sync](https://junglewise.ai/threats/technologies/hybrid-backup-sync): 4 vulnerabilities - [QNAP Photo Station](https://junglewise.ai/threats/technologies/photo-station): 4 vulnerabilities - [QNAP Qsync Central](https://junglewise.ai/threats/technologies/qsync-central): 4 vulnerabilities - [QNAP License Center](https://junglewise.ai/threats/technologies/license-center): 3 vulnerabilities - [QNAP File Station 5](https://junglewise.ai/threats/technologies/qnap-file-station-5): 3 vulnerabilities - [QNAP Qumagie](https://junglewise.ai/threats/technologies/qnap-qumagie): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "QNAP File Station vulnerabilities", https://junglewise.ai/threats/technologies/file-station, 9 November 2026.