CVE-2026-39989
CVE-2026-39989 · SSRF in QNAP Download Station
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later
CVSS 5.3 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Affected products and versions
download station
- Versions
- ≥ 5.10.x, < 5.10.1.312: Affected (custom)
- ≥ 5.11.x, < 5.11.2.321: Affected (custom)
Update to 5.10.1.312; Update to 5.11.2.321