QNAP Qfiling
CVE-2025-59384
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Qfiling web interface
-
ExploitSend request with traversal sequence
-
ExecutionEscape intended directory
-
ImpactRead arbitrary system files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Qfiling application's web interface on a QNAP NAS running the affected version 3.13.0; per CVSS AV:N/AC:L/PR:N/UI:N no authentication, user interaction, or special configuration is needed. The primary limiting factor is exposure: Qfiling is an optional QNAP application that must be installed and network-accessible, so NAS devices without Qfiling installed or with the interface restricted to trusted networks are not exposed. Impact is limited to reading files/system data accessible to the Qfiling service account; it does not inherently grant write or code execution. |
| Impact | Signals point to a moderate real-world priority rather than an emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated, low-complexity exploitation, which is the main driver of the 8.1 score. However, the EPSS score is very low at 0.07% (22nd percentile), the vector carries E:U (exploit unproven), and there is no CISA KEV listing and no public POC - so there is no evidence of active or imminent exploitation. Importantly, the impact metrics appear inflated: the description states only that attackers can 'read the contents of unexpected files or system data,' which is a confidentiality-only impact (classic CWE-22 arbitrary file read), yet the vendor scored VC:H/VI:H/VA:H. This integrity/availability impact is not supported by the described behavior and should be verified with the vendor - a read-only path traversal would more accurately be VC:H/VI:N/VA:N. Net assessment: a genuine unauthenticated information-disclosure flaw worth patching promptly on exposed instances, but current exploitation probability is low and the headline severity is likely overstated. |
| Exploit ScenarioDerived | A remote attacker who can reach the Qfiling web interface sends a crafted request containing directory-traversal sequences (e.g., ../) in a file or path parameter to escape the intended directory and retrieve arbitrary files such as configuration files, credentials, or system data. No authentication or user interaction is required per the CVSS vector. No public exploit code has been identified, and the vendor marked the exploit as unproven (E:U). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 14, 2026
Unauthenticated path traversal in QNAP Qfiling 3.13.0 allows remote attackers who can reach the application's web interface on a QNAP NAS to read files and system data outside the intended Qfiling directories, including content accessible to the Qfiling service account. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the flaw is exploitable remotely with no authentication, privileges, or user interaction, and the vendor reports it fixed in Qfiling 3.13.1 and later. No public exploit code has been identified at time of analysis and the EPSS score is negligible (0.07%, ~22nd percentile), so real-world priority is moderate rather than emergency; exposure is limited to NAS devices that actually have the optional Qfiling application installed and network-reachable.
Earlier versions of this analysis (1)
A path traversal vulnerability has been reported to affect Qfiling. The remote attackers can then exploit the vulnerability to read the contents of unexpected files or system data. [CVSS 7.5 HIGH]
RemediationAI
Vendor-released patch: upgrade Qfiling to 3.13.1 or later via QNAP App Center (or the QNAP software update mechanism on QTS/QuTS hero), as documented in advisory QSA-25-54 at https://www.qnap.com/en/security-advisory/qsa-25-54. If immediate upgrading is not possible, the most effective compensating control is reducing exposure: remove or disable the Qfiling application if it is not actively used (this fully eliminates the attack surface at the cost of losing its automated file-organization functionality), or restrict network access to the Qfiling web endpoint using NAS firewall rules, reverse-proxy ACLs, or a VPN so that only trusted management networks can reach it - noting this protects only against off-network attackers and does nothing about a malicious insider on the permitted segment. Do not expose the Qfiling interface directly to the internet, and monitor QNAP advisories for further updates; since exploitation only requires network reachability to version 3.13.0, treat any internet-facing Qfiling instance as the highest-priority upgrade target.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Qfiling is an optional QNAP application that automates file organization and archiving on QTS/QuTS hero NAS systems, operating as a background service with access to the NAS filesystem. This issue is a classic CWE-22 improper limitation of a pathname to a restricted directory (path traversal): user-supplied path input handled by the Qfiling web interface is not adequately canonicalized or constrained, letting an attacker inject traversal sequences and cause the service to resolve and return files outside the intended application directories. Because the CVSS 4.0 vector carries PR:N/UI:N/AT:N, no account on the NAS is required and no non-default configuration is needed - the only prerequisite is network reachability to the Qfiling endpoint. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) frames the impact squarely as confidentiality loss, bounded by the privileges of the account Qfiling runs under; the flaw does not inherently provide write capability or code execution. The CPE cpe:2.3:a:qnap:qfiling:3.13.0 pinpoints the vulnerable build, and the vendor advisory https://www.qnap.com/en/security-advisory/qsa-25-54 (QSA-25-54) is the authoritative reference.
Know when Qfiling gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Remote unauthenticated low-complexity file read, so AV:N/AC:L/PR:N; description indicates disclosure only, hence C:H with I:N/A:N, unlike the vendor's VI:H/VA:H.
Primary rating from Vendor (qnapsecurity).
CVSS VectorVendor: qnapsecurity
Lifecycle Timeline
3DescriptionCVE.org
A path traversal vulnerability has been reported to affect Qfiling. The remote attackers can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version: Qfiling 3.13.1 and later
Executive ViewAI
CVE-2025-59384 is an unauthenticated path-traversal flaw in QNAP's optional Qfiling application (3.13.0) that allows anyone able to reach a NAS web interface to read files and system data outside the intended Qfiling directories. Exposure is limited to QNAP NAS devices that have Qfiling installed and are network-reachable, but those appliances commonly hold backups, shared files, and system configuration whose disclosure can enable credential theft and follow-on intrusion. No public exploit code has been identified at time of analysis and EPSS is negligible, so leadership should treat this as a contained exposure-management issue whose real priority depends on how many Qfiling-enabled NAS units are reachable from untrusted networks.
Apply vendor patch (Qfiling 3.13.1 or later). If the upgrade cannot be obtained or deployed immediately, disable or uninstall the optional Qfiling application, block the Qfiling web interface from internet and untrusted network access (VPN or allow-listed management networks only), and monitor NAS access logs for path-traversal attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
GitHub PoC
Exploit-DB