QNAP QuFTP Service EUVD-2026-101990

Exploitation requires the attacker to first obtain a valid QuFTP Service user account (PR:L, confirmed by both the description 'if a remote attacker gains a user account' and the CVSS vector), and requires a victim to view the injected content (UI:A / user interaction), which is the normal precondition for XSS execution. These two factors - mandatory authentication and victim interaction - are the primary limiters on real-world risk. Affected deployments are QNAP NAS devices running QuFTP Service prior to 1.4.6, 1.5.5, or 1.6.5 (per the applicable branch); no unauthenticated or default-configuration exploitation path is indicated.

This is a moderate-risk, authenticated stored/reflected cross-site scripting flaw (CWE-79) in QNAP's QuFTP Service, not a high-priority emergency. The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H, score 6.3) and the description agree: the attacker must first obtain a legitimate user account (PR:L = authenticated), network reachable (AV:N), low complexity (AC:L), with user interaction required (UI:A), consistent with XSS where a victim must load the injected content. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals point to opportunistic rather than mass exploitation. One internal inconsistency worth noting: the vendor rates subsequent-system confidentiality/integrity/availability as High (SC:H/SI:H/SA:H) yet vulnerable-system impact as only VC:L/VI:N/VA:N, which is an unusually aggressive subsequent-system rating for a typical XSS and should be verified against the actual QuFTP advisory. Because exploitation is gated behind a valid account and victim interaction, this is a 'real but low-urgency' issue for most deployments rather than a drop-everything critical.

An attacker who has registered or been granted a low-privileged QuFTP Service user account submits input containing a malicious script payload into a field that is later rendered in another user's or an administrator's browser session. When the victim views that content in the QuFTP/QNAP management interface, the script executes in their authenticated session, potentially hijacking the session or performing actions as the victim. No public exploit code was identified at time of analysis, and the attack requires both authentication and victim interaction.