CVE-2026-39989
Received Received - Intake

Server-Side Request Forgery in QNAP Download Station

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: QNAP Systems, Inc.

Description
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-39989
EUVD
EUVD-2026-101977

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
QNAP Systems Inc. Download Station 5.10.x
QNAP Systems Inc. Download Station 5.11.x

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a server-side request forgery (SSRF) vulnerability in QNAP's Download Station software. It allows an attacker with a user account to send crafted requests from the affected server to other systems, potentially accessing internal application data.

Impact Analysis

If exploited, an attacker could read sensitive application data on your system. This requires the attacker to already have a user account on your Download Station instance. The vulnerability does not allow remote code execution or direct system compromise.

Compliance Impact

This vulnerability could potentially lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy). Organizations should patch immediately to maintain compliance.

Mitigation Strategies
  • Update Download Station to version 5.10.1.312 or later, or 5.11.2.321 or later, depending on your current version.
  • Ensure only trusted users have access to accounts that can interact with Download Station.
  • Monitor network traffic for unusual requests originating from Download Station.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-39989. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart