EUVD-2026-35976
GHSA-jhw8-2xh3-xhmf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain QNAP admin credentials via phishing or credential stuffing
-
DeliveryAuthenticate to NAS management interface over network
-
ExploitCraft HTTP request with path traversal sequences
-
ExecutionBypass path validation in file-read handler
-
ImpactRetrieve contents of arbitrary files outside web root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker first obtain a valid administrator-level account on the target QNAP device - this is explicitly stated in the description and confirmed by the CVSS 4.0 PR:H (High Privileges Required) rating. Standard user or guest accounts do not satisfy this prerequisite. The vulnerable endpoint is network-accessible (AV:N) with no attack complexity requirements (AC:L) and no additional target conditions (AT:N), meaning once admin credentials are in hand, exploitation requires no special configuration or environmental factors. Exploitation is limited to read-only access - the CVSS impact shows VI:N (no integrity impact), so file modification or command execution is not achievable through this path alone. The vulnerability affects only QTS 5.2.x and QuTS hero h5.2.x, h5.3.x, and h6.0.x branches; devices running patched builds or other OS versions are not affected. |
| Impact | The CVSS 4.0 base score of 5.1 (Medium) reflects a meaningful but bounded risk. The vector AV:N/AC:L/AT:N/PR:H/UI:N indicates network reachability with no special conditions and no user interaction required - favorable for an attacker - but the PR:H requirement for a full administrator account is a substantial gating factor that significantly reduces the realistic attacker population. The impact is limited to confidentiality (VC:L) with no integrity or availability impact (VI:N/VA:N), confirming this is a read-only information disclosure path. No EPSS data was provided in the source intelligence, and the vulnerability is absent from CISA KEV, meaning no confirmed active exploitation has been recorded. No public POC has been identified. In practice, this vulnerability is most relevant as a post-compromise escalation step - an attacker who has already gained admin credentials (through phishing, credential stuffing, or prior exploitation) could leverage this to read sensitive system files beyond their expected access scope. Organizations with QNAP devices exposed directly to the internet with default or reused admin credentials face higher realistic risk. |
| Exploit ScenarioDerived | An attacker who has obtained QNAP administrator credentials - through credential stuffing against an internet-exposed management interface, phishing, or reuse of a compromised password - authenticates to the NAS web interface and issues a crafted request containing path traversal sequences (e.g., '../../') targeting a file-reading endpoint. The unpatched system fails to sanitize the path, returning the contents of an arbitrary file such as /etc/shadow, a configuration file containing API keys, or other sensitive system data outside the web root. No public POC has been identified, but the CWE-22 class is well-understood and trivially exploitable once authenticated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 10, 2026
Path traversal in QNAP QTS and QuTS hero NAS operating systems exposes arbitrary file contents to attackers who have already obtained administrator-level access. The root cause (CWE-22) indicates insufficient sanitization of file path inputs, allowing directory escape to reach files outside intended scope. No public exploit code has been identified at time of analysis, and CISA KEV lists no active exploitation - making this a targeted post-compromise risk rather than an opportunistic mass-exploitation scenario. Vendor-released patches address all affected branches as of May 2026.
RemediationAI
Upgrade to a vendor-patched build immediately: for QTS, apply version 5.2.9.3492 build 20260507 or later; for QuTS hero, apply h5.2.9.3499 build 20260514, h5.3.4.3500 build 20260520, or h6.0.0.3459 build 20260409 depending on the installed branch. Full details are available in QNAP Security Advisory QSA-26-34 at https://www.qnap.com/en/security-advisory/qsa-26-34. As a compensating control prior to patching, restrict NAS management interfaces (typically ports 8080 and 443) to trusted internal IP ranges via firewall rules, preventing external actors from reaching authenticated endpoints - note this does not protect against an internal threat who already holds admin credentials. Enforce multi-factor authentication on all administrator accounts where supported to raise the bar for credential compromise that would gate this exploit. Avoid exposing QNAP management interfaces directly to the internet; use VPN for remote administration instead.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
QNAP QTS and QuTS hero are the Linux-based operating systems powering QNAP network-attached storage (NAS) appliances, identified by CPE strings cpe:2.3:a:qnap_systems_inc.:qts and cpe:2.3:a:qnap_systems_inc.:quts_hero. The vulnerability is classified as CWE-22 (Path Traversal), a root cause where user-supplied file path segments (e.g., '../') are not adequately neutralized before being used in server-side file operations. This class of flaw allows an attacker to reference files outside the intended directory tree - in this case to read unexpected files or system data such as configuration files, credentials stores, or OS-level data. The attack surface is network-accessible (AV:N in CVSS 4.0), meaning the vulnerable endpoint is reachable over the network, but exploitation is gated behind high privilege (PR:H), indicating the vulnerable function is accessible only to administrator-level sessions.
Know when Qts gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Primary rating from Vendor (qnap) · only source for this CVE.
CVSS VectorVendor: qnap
Lifecycle Timeline
5DescriptionCVE.org
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3459 build 20260409 and later
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors. Rated criti
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information
QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands vi
QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by
This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. R
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. Rated criti
A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. Rated high sever
A buffer overflow vulnerability in external device function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 2
A buffer overflow vulnerability in password function in QNAP QTS version 4.2.6 build 20171026, 4.3.3.0378 build 20171117
Exploit-DB