CVE-2025-29900 HIGH

CVE-2025-29900: File Station 5

Vendor Qnap Systems Inc.
Product File Station 5
Weakness CWE-770 · Uncontrolled resource consumption
Published August 29, 2025
Last update August 29, 2025
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4907 and later

Key dates

02Disclosure timeline

August 29, 2025 CVE published
August 29, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-46673 Russh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases CVE-2026-43973 gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion CVE-2026-41726 In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header CVE-2026-49955 Hermes WebUI < 0.51.270 Resource Exhaustion via passkey/options CVE-2026-44488 Axios: Allocation of Resources Without Limits or Throttling in axios