Local file disclosure via path traversal

Path traversal in QNAP File Station 5 5.5.x before 5.5.6.5190 allows local users with administrator access to read unexpected files. QNAP has not disclosed the affected function, request parameter, or path-validation operation that accepts traversal input. Exploitation requires local access and an administrator account, and the reported consequence is limited to reading unexpected files or system data.