QNAP QTS and QuTS Hero Path Traversal Vulnerability

A path traversal vulnerability exists in multiple QNAP operating system versions, including QTS 5.2.x and QuTS hero h5.2.x. This vulnerability allows remote attackers with user account access to read unintended files or system data. The issue has been addressed in QTS 5.2.5.3145 build 20250526 and later, as well as QuTS hero h5.2.5.3138 build 20250519 and later.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files or system data.

Remediation

Users are advised to update to QTS 5.2.5.3145 build 20250526 or later, or QuTS hero h5.2.5.3138 build 20250519 or later. Instructions for updating QTS or QuTS hero are available on the QNAP website.