QNAP QTS and QuTS Hero Path Traversal Vulnerability Allowing Unauthorized File Access

A path traversal vulnerability has been identified in QNAP QTS versions 5.2.x and QuTS hero h5.2.x. This vulnerability allows remote attackers with administrator access to exploit the issue and read the contents of unintended files or system data.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files or system information.

Remediation

Users can update to QTS 5.2.5.3145 build 20250526 or QuTS hero h5.2.5.3138 build 20250519. Instructions for updating QTS or QuTS hero are available on the QNAP website.