CVE-2025-66274 is a NULL pointer dereference vulnerability in QNAP Systems Inc. QTS operating system. It affects several versions and can be exploited by a remote attacker with administrator privileges to cause a denial-of-service (DoS) condition. The vulnerability has been fixed in QTS 5.2.9.3410 build 20260214 and later, as well as in specific QuTS hero versions. The CVSS 4.0 base score is 5.1, indicating a medium severity level.
A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to traverse the file system to unintended locations.
We have already fixed the vulnerability in the following versions:
QTS 5.2.8.3350 build 20251216 and later
QuTS hero h5.3.2.3354 build 20251225 and later
QuTS hero h5.2.8.3350 build 20251216 and later
CVE-2025-66278 is a path traversal vulnerability affecting QNAP Systems Inc. 's File Station 5 version 5.5.x. An attacker with a valid user account can exploit this flaw to read unauthorized files on the system, potentially exposing sensitive data. The vulnerability does not require user interaction and has a low CVSS score of 1.3, indicating limited impact and ease of exploitation. QNAP has addressed the issue in File Station 5 version 5.5.6.
CVE-2025-68406 is a path traversal vulnerability in QNAP Systems Inc. 's Qsync Central affecting version 5.0.x.x. An attacker with a valid user account can exploit this flaw to read arbitrary files on the system, potentially exposing sensitive data. The vulnerability does not require user interaction and has a low CVSS score of 1.3, indicating limited impact and ease of exploitation. QNAP has fixed the issue in Qsync Central version 5.0.
CVE-2026-22894 is a path traversal vulnerability in QNAP Systems Inc. 's File Station 5 (version 5.5.x). A remote attacker with a valid user account can exploit this flaw to access unauthorized files and system data by manipulating file paths. The vulnerability does not require user interaction and has a low CVSS score of 1.3, indicating limited impact and ease of exploitation. The issue has been fixed in File Station 5 version 5.5.6.
CVE-2025-59389 is a high-severity SQL injection vulnerability affecting QNAP Systems Inc. 's Hyper Data Protector versions 2.2.x. This vulnerability allows remote attackers to execute unauthorized code or commands without any privileges or user interaction. The issue has been fixed in Hyper Data Protector version 2.2.4.1 and later. There are no known exploits in the wild at this time.
CVE-2025-62842 is a high-severity vulnerability in QNAP Systems Inc. 's HBS 3 Hybrid Backup Sync version 26.1.x. It involves external control of file name or path (CWE-73), allowing an attacker with local network access to read or modify files or directories. The vulnerability has been fixed in version 26.2.0.938 and later. No known exploits are reported in the wild.
CVE-2025-62840 is a vulnerability in QNAP Systems Inc. 's HBS 3 Hybrid Backup Sync version 26.1.x that causes error messages to disclose sensitive information. An attacker with local network access could exploit this flaw to read application data. The issue has been fixed in version 26.2.0.938 and later. The vulnerability has a high severity rating with a CVSS score of 7.
CVE-2025-11837 is a high-severity vulnerability in QNAP Systems Inc. 's Malware Remover product, specifically affecting versions 6.6.x. It involves improper control of code generation (CWE-94), which allows remote attackers to bypass protection mechanisms without requiring privileges or user interaction. The vulnerability has been fixed in Malware Remover version 6.6.8.20251023 and later. There are no known exploits in the wild at this time.
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes.
We have already fixed the vulnerability in the following version:
QTS 5.2.8.3332 build 20251128 and later
An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). The remote attackers can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following version:
MARS (Multi-Application Recovery Service) 1.2.1.1686 and later
A path traversal vulnerability has been reported to affect Qfiling. The remote attackers can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Qfiling 3.13.1 and later
CVE-2025-59381 is a path traversal vulnerability in QNAP Systems Inc. QTS operating system. It allows a remote attacker with administrator privileges to read unauthorized files or system data. The vulnerability affects certain QTS and QuTS hero versions prior to the fixed releases. The issue has a medium severity rating with a CVSS score of 6.9. Official fixes have been released in QTS 5.2.8.3332 build 20251128 and later, QuTS hero h5.2.8.3321 build 20251117 and later, and QuTS hero h5.3.2.3354 build 20251225 and later.
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following versions:
QTS 5.2.8.3332 build 20251128 and later
QuTS hero h5.2.8.3321 build 20251117 and later
A buffer overflow vulnerability has been reported to affect License Center. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes.
We have already fixed the vulnerability in the following version:
License Center 2.0.36 and later
A path traversal vulnerability has been reported to affect several product versions. If a local attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following versions:
Qfinder Pro Mac 7.13.0 and later
Qsync for Mac 5.1.5 and later
QVPN Device Client for Mac 2.2.8 and later
An out-of-bounds read vulnerability has been reported to affect License Center. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data.
We have already fixed the vulnerability in the following version:
License Center 2.0.36 and later
A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes.
We have already fixed the vulnerability in the following version:
QTS 5.2.8.3332 build 20251128 and later
An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to read application data.
We have already fixed the vulnerability in the following versions:
QTS 5.2.8.3332 build 20251128 and later
QuTS hero h5.2.8.3321 build 20251117 and later
QuTS hero h5.3.1.3250 build 20250912 and later
An allocation of resources without limits or throttling vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.
We have already fixed the vulnerability in the following versions:
QTS 5.2.7.3256 build 20250913 and later
QuTS hero h5.2.7.3256 build 20250913 and later
QuTS hero h5.3.1.3250 build 20250912 and later
