QNAP QTS and QuTS hero Link Following Vulnerability Allowing Unintended File System Traversal

A link following vulnerability has been identified in QNAP QTS versions 5.2.x and QuTS hero h5.2.x. This vulnerability allows remote attackers to traverse the file system, accessing unintended locations. The issue has been resolved in QTS 5.2.8.3350 build 20251216 and later, as well as QuTS hero h5.2.8.3350 build 20251216 and later.

Impact

Exploitation of this vulnerability allows for unauthorized file system traversal, potentially leading to access of sensitive files or directories.

Remediation

Users are advised to update to QTS 5.2.8.3350 build 20251216 or later, or to QuTS hero h5.2.8.3350 build 20251216 or later. Instructions for updating QTS or QuTS hero are available on the QNAP website.