QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
Source: NVD ↗ · CISA KEV Catalog ↗