CVE-2019-7195

What is QNAP Photo Station?

Photo Station is a photo gallery and management application bundled with QNAP's QTS operating system for its network-attached storage (NAS) appliances, frequently exposed to the internet for public photo-sharing links.

Overview

CVE-2019-7195 is a second, related path traversal vulnerability (CWE-22, "external control of file name or path") in Photo Station, disclosed and patched alongside CVE-2019-7194 in the same December 2019 update that also fixed CVE-2019-7192 and CVE-2019-7193. Like its sibling flaw, it is unauthenticated, network-exploitable, and rated critical (CVSS 9.8).

Technical Details

A separate code path in Photo Station accepts attacker-influenced file or path values without properly filtering directory-traversal sequences, allowing a remote request to escape the intended storage directory and reach files elsewhere on the NAS. The presence of two distinct traversal flaws in the same component in one disclosure batch suggests systemic input-validation gaps across Photo Station's file-handling routines at the time.

Discovery

Disclosed through QNAP's vendor advisory process; fixed in the QTS/Photo Station updates released in December 2019.

Exploitation Context

CISA's KEV entry confirms real-world exploitation of this CVE, consistent with the broader pattern of QNAP NAS devices being targeted by ransomware operators (eCh0raix/QNAPCrypt) that have chained multiple Photo Station and QTS flaws from this same period for full device compromise.

Remediation

1. Update QTS and Photo Station to the latest patched versions.
2. Take Photo Station offline or restrict it to LAN-only access if it isn't actively required.
3. Block inbound internet access to NAS management and photo-sharing ports at the firewall/router.
4. Scan the device with QNAP's Malware Remover and check for unexpected files or scheduled tasks.
5. Rotate any credentials stored on or accessible from the NAS if compromise is suspected.