QNAP QTS and QuTS hero Path Traversal Vulnerability Allowing Unauthorized File Access

A path traversal vulnerability has been identified in QNAP QTS and QuTS hero operating systems. This vulnerability allows remote attackers with administrator access to exploit the issue and read unintended files or system data. The vulnerability affects multiple QNAP operating system versions, including QTS 5.2.x and QuTS hero h5.2.x and h5.3.x.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files or system data.

Remediation

Users can update to QTS 5.2.8.3332 build 20251128 or later, or QuTS hero h5.2.8.3321 build 20251117 or later. For QuTS hero h5.3.x, the update to version h5.3.1.3250 build 20250912 or later is recommended.