This vulnerability (CWE-22) in QNAP QTS allows an authenticated remote attacker with administrator rights to exploit a path traversal flaw to access files outside of intended directories. The issue affects QTS 5.2.0 and related versions. The vendor has issued patches in QTS 5.2.9.3492 and later builds, and in multiple QuTS hero versions starting with h5.2.9.3499. The CVSS 4.0 base score is 5.1, indicating a medium severity level.

An attacker with administrator privileges can exploit this vulnerability to read arbitrary files on the system, potentially exposing sensitive system data or configuration files. There is no indication of remote code execution or privilege escalation beyond the requirement of administrator access.

The vulnerability has been fixed by QNAP in QTS 5.2.9.3492 build 20260507 and later, and in QuTS hero h5.2.9.3499 build 20260514 and later versions. Users should upgrade affected systems to these fixed versions or later to remediate the issue. No other mitigation steps are indicated by the vendor advisory.