QNAP Qfinder Pro, Qsync, and QVPN Device Client Path Traversal Vulnerability

A path traversal vulnerability exists in QNAP Qfinder Pro, Qsync, and QVPN Device Client for Mac, specifically in versions prior to the fixed releases. This vulnerability allows local attackers with user accounts to access and read unintended files or system data. The issue has been resolved in Qfinder Pro Mac 7.13.0 and later, Qsync for Mac 5.1.5 and later, and QVPN Device Client for Mac 2.2.8 and later.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files or system data.

Remediation

Users are advised to update to the latest versions of Qfinder Pro, Qsync, and QVPN Device Client for Mac. The latest updates can be found on the QNAP Utilities page.