EUVD-2026-101880
GHSA-pw2w-wj8f-48p9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged QNAP user account
-
ExploitSend request with path-traversal sequences to QcalAgent
-
ExecutionService resolves path outside intended directory
-
ImpactRead sensitive files and system data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to first gain a valid (low-privileged) user account on the target QNAP device running QcalAgent, as reflected by PR:L in the CVSS vector and the description's 'if a remote attacker gains a user account' wording - it is NOT unauthenticated. The affected component is the optional QcalAgent application (Qcalendar) on QNAP NAS, versions 1.1.x below 1.1.10, so devices without QcalAgent installed or already updated to 1.1.10+ are not exposed. The limiting factors are the authentication prerequisite and the need for the QcalAgent app to be installed/enabled; no user interaction (UI:N) is required once an account is held. |
| Impact | The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 8.7) rates this as network-exploitable with low attack complexity and only low privileges required, which on paper is a serious authenticated-remote issue. However, there is a notable conflict: the description characterizes the flaw purely as the ability to 'read the contents of unexpected files or system data' - a classic CWE-22 path-traversal read primitive implying confidentiality impact only - yet the vendor vector asserts HIGH integrity and HIGH availability impact (VI:H/VA:H). This integrity/availability rating is not substantiated by the description and should be verified with QNAP before being treated as confirmed; the realistic impact appears to be unauthorized file disclosure. On exploitation likelihood: this is not listed in CISA KEV, no EPSS score was provided in the input, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The PR:L requirement (a valid user account on the QNAP device) is a meaningful mitigating factor that limits this to attackers who have already authenticated, placing it below internet-wide unauthenticated bugs in priority. Net assessment: a credible, patch-worthy authenticated information-disclosure flaw, but absent KEV/EPSS/POC signals it is a 'patch promptly' rather than 'emergency' item, and the inflated VI:H/VA:H metrics warrant vendor confirmation. |
| Exploit ScenarioDerived | An attacker who has obtained a low-privileged user account on a QNAP NAS running QcalAgent before 1.1.10 sends a crafted request containing directory-traversal sequences to the QcalAgent service, causing it to return files outside its intended directory (e.g., configuration, credential, or system data files). No public exploit code is referenced, and the attack is network-reachable with low complexity but requires prior authentication (PR:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 15, 2026
Path traversal in QNAP's QcalAgent (Qcalendar) app for NAS devices lets a remote attacker who already holds a low-privileged user account read files and system data outside the intended directory. Only installations running QcalAgent 1.1.x below 1.1.10 are exposed, since the flaw is fixed in 1.1.10 and later, and the authentication prerequisite (PR:L in both the vendor CVSS 4.0 vector and our assessed CVSS 3.1 vector) means unauthenticated outsiders cannot reach it. No KEV listing and no public exploit code exists at time of analysis, but the vendor scores it 8.7 under CVSS 4.0, so patching should be prioritized wherever the optional app is installed and user accounts are shared broadly.
Earlier versions of this analysis (1)
An authenticated remote path traversal in QNAP QcalAgent (the QNAP qcalendar app) before version 1.1.10 allows an attacker who already holds a valid low-privileged user account on the NAS to read files and system data outside the intended directory. The primary limiting factor is that account requirement (CVSS PR:L), which rules out unauthenticated exploitation; given an account, the attack is remote over the network, low complexity, and requires no user interaction. The vendor rates this CVSS 4.0 6.3, while our independent assessment is a moderate CVSS 3.1 6.3 with confidentiality-only impact (C:H/I:N/A:N); no public exploit identified at time of analysis, and a fixed build is available.
RemediationAI
The primary fix is to upgrade QcalAgent to version 1.1.10 or later - this is the vendor-released patched version, confirmed in QNAP's app release notes at https://www.qnap.com/en/app-release-notes?keyword=QcalAgent&app=qcalendar&product-line=nas; update through App Center on the NAS or by installing the current QPKG build, then confirm the reported version is 1.1.10+. If immediate upgrade is not possible, the most effective compensating control is to stop and uninstall or disable the QcalAgent/Qcalendar app entirely, since the vulnerable code only exists where the optional application is installed - the trade-off is loss of the calendar/agent functionality until patched. Because exploitation requires a valid low-privileged account (CVSS PR:L), additionally reduce exposure by auditing and pruning local user accounts, enforcing strong unique credentials and MFA on NAS logins, restricting which accounts can reach the QcalAgent web interface via QNAP's access-control or reverse-proxy rules, and limiting management/app access to trusted internal networks - these reduce the likelihood that an attacker can satisfy the authentication prerequisite but do not remediate the traversal itself. Finally, review NAS logs for anomalous file-read requests or unusual paths targeting the QcalAgent service to detect any attempted exploitation, and note that no public exploit code was identified at time of analysis, so scanning pressure is expected to remain low in the short term.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal) in QcalAgent, QNAP's calendar/calendaring agent application packaged as an optional QPKG on QNAP NAS systems. Because the vulnerable component is the application layer rather than the NAS firmware itself, the attack surface is limited to hosts where QcalAgent has actually been installed and enabled; QNAP packages it as the 'qcalendar' product line in its app-release-notes catalog, and the EUVD entry (EUVD-2026-101880) scopes affected code to QcalAgent 1.1.x before 1.1.10. Path traversal of this class typically arises when user-supplied path input is concatenated onto a base directory without canonicalization or an allow-list check, allowing '../' sequences (or encoded equivalents) to escape the intended root and read arbitrary files. Our independent assessment models the impact as confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), whereas the vendor's CVSS 4.0 vector claims high integrity and availability impact as well (VI:H/VA:H, score 8.7); the two agree, however, on the network attack vector, low attack complexity, no user interaction, and - critically - the need for a valid low-privileged account, so the practical exploitation bar is an authenticated foothold on the NAS, not anonymous access.
Know when Qnap gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable path traversal needing a user account gives AV:N/AC:L/PR:L/UI:N; description supports confidentiality read only, so C:H with I:N/A:N (vendor's VI:H/VA:H unsupported).
Primary rating from Vendor (qnapsecurity).
CVSS VectorVendor: qnapsecurity
Lifecycle Timeline
3DescriptionCVE.org
A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version: QcalAgent 1.1.10 and later
Executive ViewAI
QNAP NAS devices running the optional QcalAgent (Qcalendar) app at version 1.1.x below 1.1.10 are exposed to CVE-2026-41544, a HIGH-severity path-traversal flaw (CVSS 8.7) that lets anyone holding a valid low-privileged NAS account read files and system data outside the intended directory. Because the flaw requires an authenticated foothold rather than an outside attacker, the practical risk concentrates in organizations where the app is installed and user credentials are widely shared or poorly deprovisioned, meaning any credential holder - including contractors or former staff - could reach data they should not see. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status, but the vendor-rated severity and a straightforward fix make timely remediation the prudent course.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Rated criti
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticate
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. R
Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. Rated cr
This external control of file name or path vulnerability allows remote attackers to access or modify system files. Rated
Exploit-DB