# CVE-2026-24717: QNAP QTS and QuTS hero path traversal

Source: https://junglewise.ai/threats/cve-2026-24717-qnap-qts-and-quts-hero-path-traversal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-24717 · Severity: info · CVSS 5.1 · Published 2026-06-10

A security vulnerability has been identified in QNAP storage device operating systems that could allow an attacker to access sensitive system files. To exploit this, an attacker must first obtain administrator-level access to the device. Once authenticated, they could bypass directory restrictions to read internal data, potentially leading to further compromise of the storage system or its data.

Technologies: [QNAP QTS](https://junglewise.ai/threats/technologies/qts). Vendors: [QNAP](https://junglewise.ai/threats/vendors/qnap).

## Quick answers

**Is CVE-2026-24717 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24717 being exploited in the wild.

**How severe is CVE-2026-24717?** Informational severity, with a CVSS score of 5.1, published 10 June 2026.

**Which products and versions are affected?** QNAP QTS 5.2.9.3492 build 20260507 and earlier.

**Is there a fix for CVE-2026-24717?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-24717 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-24717?** Check whether you run QNAP QTS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in multiple QNAP operating systems, including QTS and QuTS hero. The flaw allows a remote attacker with high privileges (administrator account) to bypass directory access restrictions. By sending specially crafted requests, the attacker can read the contents of files outside of the intended directory, including sensitive system data. The vulnerability is addressed in QTS 5.2.9.3492, QuTS hero h5.2.9.3499, h5.3.4.3500, and h6.0.0.3459.

## Affected products

- QNAP QTS 5.2.9.3492 build 20260507 and earlier
- QNAP QuTS hero h5.2.9.3499 build 20260514 and earlier; h5.3.4.3500 build 20260520 and earlier; h6.0.0.3459 build 20260409 and earlier

## Timeline

- 2026-06-10: disclosed
- 2026-06-10: advisory

## References

- [https://www.qnap.com/en/security-advisory/qsa-26-34](https://www.qnap.com/en/security-advisory/qsa-26-34)

## Related threats

- [QNAP QTS and QuTS hero NULL pointer dereference DoS](https://junglewise.ai/threats/cve-2026-24716-qnap-qts-and-quts-hero-null-pointer-dereference-dos)
- [QNAP QTS and QuTS hero command injection](https://junglewise.ai/threats/cve-2026-22893-qnap-qts-and-quts-hero-command-injection)
- [QNAP QTS and QuTS hero command injection](https://junglewise.ai/threats/cve-2025-66273-qnap-qts-and-quts-hero-command-injection)
- [QNAP QTS and QuTS web parameter manipulation](https://junglewise.ai/threats/cve-2025-59382-qnap-qts-and-quts-web-parameter-manipulation)
- [QNAP QTS and QuTS hero NULL pointer dereference](https://junglewise.ai/threats/cve-2025-66274-qnap-qts-and-quts-hero-null-pointer-dereference)