Is CVE-2025-59381 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-59381 being exploited in the wild.

How severe is CVE-2025-59381?

Medium severity, with a CVSS score of 4.9, published 2 January 2026.

Which products and versions are affected?

QNAP Systems, Inc. QuTS hero before h5.2.8.3321 build 20251117.

Is there a fix for CVE-2025-59381?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-59381 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2025-59381?

Check whether you run QNAP Systems or Inc. QuTS hero at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-59381: QNAP QTS and QuTS hero path traversal

CVE-2025-59381 · Severity: medium · CVSS 4.9 · Published 2026-01-02

A security vulnerability has been identified in QNAP's QTS and QuTS hero operating systems, which power their Network Attached Storage (NAS) devices. If an attacker manages to obtain administrator credentials, they can exploit this flaw to access sensitive system files and data that should normally be restricted. This could lead to the exposure of confidential information or system configurations. QNAP has released firmware updates to address this issue, and users are advised to update their devices immediately.

Technologies: QNAP Systems, Inc. QuTS hero. Vendors: QNAP Systems, Inc..

Quick answers

Is CVE-2025-59381 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-59381 being exploited in the wild.
How severe is CVE-2025-59381?: Medium severity, with a CVSS score of 4.9, published 2 January 2026.
Which products and versions are affected?: QNAP Systems, Inc. QuTS hero before h5.2.8.3321 build 20251117.
Is there a fix for CVE-2025-59381?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-59381 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2025-59381?: Check whether you run QNAP Systems or Inc. QuTS hero at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in several versions of QNAP's QTS and QuTS hero operating systems. The flaw allows a remote attacker who has already obtained administrator-level privileges to bypass directory restrictions. By submitting specially crafted requests, the attacker can read the contents of arbitrary files or sensitive system data outside of the intended directory scope. The vulnerability is addressed in QTS 5.2.8.3332 build 20251128, QuTS hero h5.2.8.3321 build 20251117, and QuTS hero h5.3.2.3354 build 20251225.

Affected products

QNAP Systems, Inc. QTS 5.2.x before 5.2.8.3332 build 20251128
QNAP Systems, Inc. QuTS hero h5.2.x before h5.2.8.3321 build 20251117
QNAP Systems, Inc. QuTS hero h5.3.x before h5.3.2.3354 build 20251225

Timeline

2026-01-02: disclosed
2026-01-03: advisory: Vendor advisory QSA-25-51 published

References

https://www.qnap.com/en/security-advisory/qsa-25-51

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.