EUVD-2026-101991
GHSA-v3c8-8f48-fwpq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Qsirch web service on NAS
-
DeliverySend request with traversal sequence
-
ExploitEscape intended directory scope
-
ExecutionRead arbitrary file contents
-
ImpactExfiltrate sensitive system data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Qsirch full-text search application running on a QNAP NAS (Qsirch is an optional add-on app, so only NAS devices with it installed and its web interface accessible are affected). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are stated as prerequisites - the limiting factors are that Qsirch must be installed and its service exposed to the attacker's network path, and that devices already updated to Qsirch 7.0.3.0 or later are not vulnerable. |
| Impact | The input CVSS 4.0 base score of 9.3 (CRITICAL) with vector AV:N/AC:L/AT:N/PR:N/UI:N indicates a remotely exploitable, low-complexity, unauthenticated path traversal requiring no user interaction - attributes that normally justify high prioritization. However, the signals conflict: the vendor's vector claims full triad impact (VC:H/VI:H/VA:H), yet the description states the flaw only allows an attacker to 'read the contents of unexpected files or system data,' which is a confidentiality-only impact consistent with CWE-22 arbitrary file read. The claimed HIGH integrity and availability impacts are not supported by the description and appear overstated; realistic impact is high confidentiality with little-to-no integrity/availability effect, which would lower the true base score. No EPSS probability is provided, the CVE is not listed in CISA KEV, and no public exploit code is referenced, so there is no evidence of active exploitation or weaponization. Net assessment: a genuine, easily-reachable unauthenticated information-disclosure flaw worth prompt patching on exposed instances, but the raw 9.3 likely overstates real-world severity because the impact is primarily disclosure, not full compromise - verify the integrity/availability claims with QNAP before treating this as a full-compromise CRITICAL. |
| Exploit ScenarioDerived | A remote attacker sends a crafted HTTP request to an internet-exposed or network-reachable QNAP NAS running the Qsirch search application, manipulating a file-path parameter with directory-traversal sequences to escape the intended directory. Because no authentication or user interaction is required, the attacker retrieves sensitive files or system data such as configuration files or credentials. No public proof-of-concept exploit is referenced at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Path traversal in QNAP Qsirch lets remote attackers reach the full-text search application without authentication and read files and system data outside the intended directory structure on the host NAS. The vendor states the flaw is fixed in Qsirch 7.0.3.0 and later, so only NAS devices running an earlier build of this optional app - and exposing its web interface to the attacker's network path - remain at risk; no public exploit code and no confirmed active exploitation were identified at time of analysis. Our independent assessment scores the issue at CVSS 3.1 8.6-class severity on the confidentiality axis (C:H/I:N/A:N), meaning the realistic worst case is read-only disclosure of sensitive files rather than the file modification or service disruption implied by the higher input CVSS 4.0 score of 9.3.
RemediationAI
Upgrade Qsirch to version 7.0.3.0 or later - the vendor-stated fixed release - through the QNAP App Center on each affected NAS, and verify the installed version against the QNAP application release notes at https://www.qnap.com/en/app-release-notes?keyword=Qsirch&app=Qsirch&product-line=nas; applying the update is the only complete fix, and there is no need to expose the app to the internet during the upgrade. If the update cannot be applied immediately, the most effective compensating control is to uninstall or disable Qsirch from the App Center, which removes the attack surface entirely at the cost of losing full-text search over indexed files on that device. Where Qsirch must remain operational, restrict network reachability to its web interface using NAS firewall rules, a management VLAN, or a VPN/reverse proxy that enforces authentication, so that only trusted hosts can reach the service - the trade-off is that reverse-proxy authentication can break integrations or API clients that expect direct access, and firewall rules must be maintained as client address ranges change. Note that the input data does not identify a separate workaround that fully neutralizes the traversal while leaving the search interface exposed to untrusted networks. Monitor QNAP's security advisory channels for any further updates, and audit NAS logs for unexpected file-read requests against the Qsirch service as a detection measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal). Qsirch is an optional full-text indexing and search add-on for QNAP NAS devices, deployed on top of the QTS/QuTS hero operating system and normally exposed through a web interface on the NAS. The CPE string cpe:2.3:a:qnap_systems_inc.:qsirch:*:*:*:*:*:*:*:* confirms this is a vendor application component with no version constraint applied, consistent with all builds prior to the fixed 7.0.3.0 release being affected. In a path traversal of this class, user-supplied input that is consumed by file-system operations (for example a path, filename, or index location parameter handled by the search service) is not canonicalized and not confined to a designated base directory, so sequences such as ../ escape the intended folder and let the request resolve to arbitrary paths on the underlying volume. The CVSS vectors from both the vendor (CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N) and our assessment (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) agree that no privileges (PR:N), no user interaction (UI:N), no attack preconditions, and no non-default configuration are needed - the only gating factors are that Qsirch must be installed and that its service must be network-reachable. The confidentiality-only impact (C:H/I:N/A:N in our assessment) indicates the weakness is a disclosure primitive: an attacker can read content they should not access, but the available data does not support claims of file overwrite, code execution, or denial of service.
Know when Qsirch gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network-reachable path traversal yields AV:N/AC:L/PR:N/UI:N; impact is arbitrary file read so C:H, with I and A set to N since the description shows no write or availability effect.
Primary rating from Vendor (qnap).
CVSS VectorVendor: qnap
Lifecycle Timeline
2DescriptionCVE.org
A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version: Qsirch 7.0.3.0 and later
Executive ViewAI
QNAP NAS appliances running the optional Qsirch full-text search application on builds earlier than 7.0.3.0 are exposed to a critical path-traversal flaw that can let an attacker reaching the app's web interface read files and system data outside the intended directory structure. The realistic worst case is read-only disclosure of sensitive files rather than modification or service disruption, but that still means business documents, configuration data, and potentially credentials stored on those devices could be readable by an unauthorized party. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a limited window to remediate before an exploit becomes available rather than an active breach requiring incident response.
Apply vendor patch (upgrade to Qsirch 7.0.3.0 or later per the vendor statement in this record; confirm availability with QNAP, as the patch-status field reports no patch available). Until the upgrade is confirmed on all instances, interim mitigations are: stop or uninstall the Qsirch application where it is not required, block all inbound access to the Qsirch web interface from untrusted networks, disable port forwarding and UPnP on edge devices, network-segment or isolate affected NAS appliances, restrict the interface to administrative networks, and monitor NAS and Qsirch logs for anomalous file-read activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB