Executive brief
A security vulnerability has been identified in QNAP's QTS and QuTS hero operating systems, which power their Network Attached Storage (NAS) devices. If an attacker manages to obtain administrator credentials, they can exploit this flaw to access sensitive system files and data that should normally be restricted. This could lead to the exposure of confidential information or system configurations. QNAP has released firmware updates to address this issue, and users are advised to update their devices immediately.
Technical details
A path traversal vulnerability (CWE-22) exists in several versions of QNAP's QTS and QuTS hero operating systems. The flaw allows a remote attacker who has already obtained administrator-level privileges to bypass directory restrictions. By submitting specially crafted requests, the attacker can read the contents of arbitrary files or sensitive system data outside of the intended directory scope. The vulnerability is addressed in QTS 5.2.8.3332 build 20251128, QuTS hero h5.2.8.3321 build 20251117, and QuTS hero h5.3.2.3354 build 20251225.
Affected products
- QNAP Systems, Inc. QTS 5.2.x before 5.2.8.3332 build 20251128
- QNAP Systems, Inc. QuTS hero h5.2.x before h5.2.8.3321 build 20251117
- QNAP Systems, Inc. QuTS hero h5.3.x before h5.3.2.3354 build 20251225
Timeline
- 2026-01-02: disclosed
- 2026-01-03: advisory: Vendor advisory QSA-25-51 published