Qsync Central CVE-2026-24718

Exploitation requires the attacker to first hold a valid Qsync Central user account (CVSS PR:L) - the description explicitly states 'if a remote attacker gains a user account.' Given that prerequisite, no further special configuration is indicated; the path-traversal input is processed over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). The principal limiting factor is the authentication requirement, which confines realistic exploitation to compromised-credential, insider, or post-account-provisioning scenarios rather than unauthenticated internet-facing attack. Impact is further limited to reading file contents or system data (no write/modify, no availability loss). Running a fixed build (5.0.0.7, 5.1.0.3, 5.2.0.5, 5.3.0.2 or later) removes the exposure.

This is a low-priority issue despite being network-reachable. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a remotely reachable but authenticated flaw (PR:L) requiring a valid user account, with only limited confidentiality impact (VC:L) and no integrity or availability impact (VI:N/VA:N/SC:N). The vector's exploit-maturity metric is E:U (unreported/no exploit reported), consistent with the absence of a CISA KEV listing and no public POC. There is no EPSS score provided in the input, so exploitation probability cannot be quantified here. All signals align in the same low-risk direction: the base score of 1.3 reflects both the authentication prerequisite and the narrow, read-only, low-confidentiality outcome. The only mild tension is the authenticated-but-remote nature - an attacker must first obtain a user account, which materially limits real-world exploitability to post-compromise or insider scenarios rather than opportunistic internet-wide attacks. No key data appears internally contradictory; the main gap is the lack of EPSS and any independent third-party advisory beyond QNAP's own release notes.

An attacker who has already obtained a low-privilege Qsync Central user account (via phishing, credential reuse, or an insider) sends crafted path-traversal input to a file-handling endpoint to read files outside the intended directory, such as configuration or other users' data on the NAS. No public exploit code is identified at time of analysis, and the CVSS exploit-maturity flag is Unreported. Impact is limited to disclosure of a narrow set of file contents or system data (CVSS VC:L).