Executive brief
A security vulnerability has been identified in QNAP storage device operating systems, including QTS and QuTS hero. This flaw allows remote attackers to execute malicious scripts in a user's browser if they are tricked into visiting a specific link. Successful exploitation could allow an attacker to bypass security controls, steal sensitive session information, or access application data stored on the device.
Technical details
A cross-site scripting (XSS) vulnerability (CWE-79) exists in several QNAP operating system versions, including QTS and QuTS hero. The vulnerability stems from improper neutralization of input during web page generation. A remote attacker can exploit this by enticing a user to interact with a malicious link or page, leading to the execution of arbitrary script code in the context of the victim's browser session. This can be used to bypass security mechanisms or access sensitive application data. QNAP has released patches for QTS 5.2.x and QuTS hero h5.2.x, h5.3.x, and h6.0.x.
Affected products
- QNAP Systems, Inc. QTS 5.2.9.3492 build 20260507 and earlier
- QNAP Systems, Inc. QuTS hero h5.2.9.3499 build 20260514 and earlier; h5.3.4.3500 build 20260520 and earlier; h6.0.0.3500 build 20260520 and earlier
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory