CVE-2022-27593
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station.
- Severity
- 9.1 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 87.91%
- Chance of exploitation in the next 30 days. Higher than 99.76% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Sep 8, 2022
- Weakness
- CWE-610 Externally Controlled Reference to a Resource in Another Sphere
- CWE-610 Externally Controlled Reference to a Resource in Another Sphere
- Fix
- None yet
- No fixed version published
Description
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Weakness
CWE-610: Externally Controlled Reference to a Resource in Another Sphere
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
CWE-610: Externally Controlled Reference to a Resource in Another Sphere
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
References
Advisories
Other links
Timeline
- Added to CISA's Known Exploited Vulnerabilities catalog
- Published
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-wjgm-6hv5-3cvf jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution | Medium | Same weakness, CWE-610 |
| GHSA-55cf-xx38-4p9p OpenClaw: Workspace dotenv files cannot override connector endpoint hosts | Medium | Same weakness, CWE-610 |
| GHSA-45cg-2683-gfmq OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files | High | Same weakness, CWE-610 |
| GHSA-f43r-cc68-gpx4 External Control of File Name or Path in Langflow | High | Same weakness, CWE-610 |
| CVE-2025-0111 An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web… | High Known exploited | Same weakness, CWE-610 |
| GHSA-25qx-vfw2-fw8r Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking | Medium | Same weakness, CWE-610 |
| GHSA-5mqx-rpxv-mvxj HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration | High | Same weakness, CWE-610 |
| GHSA-mpwp-42x6-4wmx Grafana Fine-grained access control vulnerability | Critical | Same weakness, CWE-610 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor