CVE-2024-48864 is a critical severity (CVSS 9.1) flaw in QNAP File Station 5 where files or directories are accessible to external parties. If exploited, remote attackers could read or write files or directories. QNAP says it is fixed in File Station 5 version 5.5.6.4741 and later.
What's affected
The record names QNAP File Station 5 as affected. QNAP states the fix is in File Station 5 version 5.5.6.4741 and later.
File Station is the file management app on QNAP NAS devices, so any NAS with the app installed and reachable could be exposed. The record does not list the exact range of earlier versions, so treat anything below 5.5.6.4741 as affected until the QNAP advisory QSA-24-55 says otherwise.
How to check if you're exposed
Open the App Center on the NAS, find File Station, and read its version. You can also check it from the App Center list of installed apps.
If the version is below 5.5.6.4741, update it. Next check whether the NAS or File Station is reachable from the internet, for example through port forwarding, QNAP cloud links or a reverse proxy. Review file access logs for unexpected reads or writes in shared folders.
What to do now
- Update File Station 5 to 5.5.6.4741 or later through the App Center.
- Remove direct internet exposure of the NAS management and file services.
- Review shared folders and permissions for data that should not be reachable.
- Check the logs for access from unfamiliar addresses.
- Back up important data to a location the NAS cannot overwrite.
Why it matters
The weakness is CWE-552 (Files or Directories Accessible to External Parties). Files or directories end up reachable by people who should not reach them, because access control does not cover the path being requested. The impact in the record is both read and write, so an attacker could take data and also change it.
NAS devices hold shared files and backups, and they are often exposed to the internet for convenience. That combination makes access control bugs there valuable. The record does not flag exploitation and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-48864.
Quick check
What version of File Station fixes CVE-2024-48864?
QNAP says File Station 5 version 5.5.6.4741 and later.
Should my NAS face the internet?
Avoid it where you can. Use a VPN for remote access instead of exposing services.
Sources
Last reviewed: 19 October 2026.
