CVE-2026-24717 is a path traversal vulnerability in QNAP QTS operating system that allows a remote attacker with administrator privileges to read files outside the intended file system paths. The vulnerability affects QTS versions prior to 5.2.9.3492 and QuTS hero versions prior to the specified fixed builds. The CVSS 4.0 base score is 1.2, indicating low severity due to required administrator privileges and limited impact. The vendor has released patches in QTS 5.2.9.3492 build 20260507 and later, and corresponding QuTS hero versions, addressing this issue.

An attacker who already has administrator access can exploit this vulnerability to read arbitrary files on the system, potentially exposing sensitive system data. The impact is limited by the requirement for administrator privileges and the low CVSS score. There are no known exploits in the wild at this time.

The vulnerability has been fixed in QTS 5.2.9.3492 build 20260507 and later, and in QuTS hero h5.2.9.3499 build 20260514 and later, including h5.3.4.3500 build 20260520 and h6.0.0.3459 build 20260409 and later. Users should upgrade to these fixed versions to remediate the issue. No additional mitigation steps are indicated by the vendor.