Qfiling
Monthly
Unauthenticated path traversal in QNAP Qfiling 3.13.0 allows remote attackers who can reach the application's web interface on a QNAP NAS to read files and system data outside the intended Qfiling directories, including content accessible to the Qfiling service account. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the flaw is exploitable remotely with no authentication, privileges, or user interaction, and the vendor reports it fixed in Qfiling 3.13.1 and later. No public exploit code has been identified at time of analysis and the EPSS score is negligible (0.07%, ~22nd percentile), so real-world priority is moderate rather than emergency; exposure is limited to NAS devices that actually have the optional Qfiling application installed and network-reachable.
Unauthenticated path traversal in QNAP Qfiling 3.13.0 allows remote attackers who can reach the application's web interface on a QNAP NAS to read files and system data outside the intended Qfiling directories, including content accessible to the Qfiling service account. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the flaw is exploitable remotely with no authentication, privileges, or user interaction, and the vendor reports it fixed in Qfiling 3.13.1 and later. No public exploit code has been identified at time of analysis and the EPSS score is negligible (0.07%, ~22nd percentile), so real-world priority is moderate rather than emergency; exposure is limited to NAS devices that actually have the optional Qfiling application installed and network-reachable.