Qsync Central EUVD-2026-101978

Exploitation requires the attacker to first obtain a valid Qsync Central user account (PR:L) - this is the primary limiting factor and is stated explicitly in the description. Given an account, the attacker abuses the application's handling of unix symbolic links (CWE-61): a privileged Qsync Central file operation follows an attacker-planted symlink out of its intended directory. Exploitation is limited to installations running Qsync Central versions prior to the listed fixes (before 5.0.0.7 / 5.1.0.3 / 5.2.0.5 / 5.3.0.2) and requires that account provisioning on the NAS be reachable by the attacker; no user interaction by a victim is needed (UI:N).

This is a medium-severity (CVSS 4.0 base 5.3), authenticated issue, not a priority emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable but authenticated attack (PR:L) against the Qsync Central NAS application, with only low impact to confidentiality, integrity, and availability (VC:L/VI:L/VA:L, no scope change). The description confirms the PR:L requirement: 'If a remote attacker gains a user account.' There is no CISA KEV listing and no public exploit identified at time of analysis; no EPSS score was provided in the input, so exploitation probability cannot be quantified. The signals are internally consistent - network vector plus a required low-privilege account plus modest symlink-following impact (CWE-61) - so this reads as a genuine-but-limited post-authentication local-file-tampering/disclosure weakness rather than a widely weaponizable remote flaw. The main gating factor is that an attacker must first obtain a valid user account, which meaningfully constrains real-world risk. EPSS data is missing and should be checked to refine prioritization.

An attacker who has already obtained a low-privileged Qsync Central user account creates or manipulates a symbolic link within a sync/working directory so that a privileged Qsync Central operation follows it to a file outside the intended path. When the service dereferences the symlink, the attacker reads or overwrites files they should not have access to, yielding limited disclosure or tampering. No public proof-of-concept was identified at time of analysis.