CVE-2025-58465
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability has been reported in Download Station. If a remote attacker gains a user account, they can exploit it to bypass security mechanisms or read application data.
Risk Assessment
An authenticated attacker could execute malicious script in a victim's browser, potentially leading to session or data theft. Organizations exposing Download Station to users are at risk from attacks requiring only a low-privileged account.
Recommendation
Update Download Station to version 5.10.0.305 (2025/09/16) or later. Restrict access to trusted networks and review user account permissions.
Other vulnerabilities in Download Station
See all- CVE-2026-39989Medium
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. The vulnerability has been fixed in versions 5.10.1.312 and 5.11.2.321 and later.
- CVE-2026-34014High
An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.
- CVE-2026-39993High
A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
- CVE-2025-58463Medium
A relative path traversal vulnerability affects Download Station. A remote attacker with an administrator account can read unexpected files or system data. The fix is available in versions 5.10.0.305 and 5.10.0.304.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: Download Station 5.10.0.305 ( 2025/09/16 ) and later Download Station 5.10.0.304 ( 2025/09/08 ) and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS