CVE-2025-62842: QNAP HBS 3 Hybrid Backup Sync path traversal

CVE-2025-62842 · Severity: high · CVSS 7.8 · Published 2026-01-02

A security vulnerability has been identified in QNAP's HBS 3 Hybrid Backup Sync, a tool used for data backup, restoration, and synchronization on QNAP NAS devices. An attacker with access to the local network could exploit this flaw to read or modify sensitive files and directories. This could lead to unauthorized data access or the corruption of critical backup information.

Technologies: QNAP Hybrid Backup Sync. Vendors: QNAP, QNAP Systems, Inc..

Quick answers

Is CVE-2025-62842 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-62842 being exploited in the wild.
How severe is CVE-2025-62842?
High severity, with a CVSS score of 7.8, published 2 January 2026.
Which products and versions are affected?
QNAP Systems, Inc. HBS 3 Hybrid Backup Sync 26.1.x and earlier versions before 26.2.0.938.
Is there a fix for CVE-2025-62842?
A patch was published on 2026-01-03: QNAP updated advisory with fix details Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-62842 attacked?
It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2025-62842?
Check whether you run QNAP Hybrid Backup Sync, QNAP Systems or Inc. HBS 3 Hybrid Backup Sync at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An external control of file name or path vulnerability (CWE-73) exists in QNAP HBS 3 Hybrid Backup Sync versions 26.1.x and earlier. The flaw allows an attacker with local network access to manipulate file paths, leading to unauthorized file system operations. According to the CVSS metrics, the vulnerability can be exploited with low privileges and no user interaction, potentially resulting in a total loss of confidentiality, integrity, and availability for the affected data. The issue was addressed in HBS 3 Hybrid Backup Sync version 26.2.0.938.

Affected products

  • QNAP Systems Inc. HBS 3 Hybrid Backup Sync 26.1.x and earlier versions before 26.2.0.938

Timeline

  • 2025-11-08: advisory: Initial advisory published by QNAP
  • 2026-01-02: disclosed: CVE published to NVD
  • 2026-01-03: patched: QNAP updated advisory with fix details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.