Read the docs
TI-2018-14133 Aliases CVE-2018-19945GHSA-xc2v-fcxv-wj59

Improper Limitation of a Pathname to a Restricted Directory in QTS

Priority MEDIUM 41CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

A vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6. Caused by improper limitations of a pathname to a restricted directory, this vulnerability allows for renaming arbitrary files on the target system, if exploited. QNAP have already fixed this vulnerability in the following versions: QTS 4.3.6.0895 build 20190328 (and later) QTS 4.3.4.0899 build 20190322 (and later) This issue does not affect QTS 4.4.x or QTS 4.5.x.

Why it matters now

EPSS 0.01124 66th percentileScored 2026-11-07
Fix Fixed QTS (QNAP Systems Inc.): 4.3.6.0895, 4.3.4.0899, 4.5.x +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQTSbefore 4.3.6.08954.3.6.0895Patch availableCNA
QNAPQTSbefore 4.3.4.08994.3.4.0899Patch availableCNA
QNAPQTS—4.5.x, 4.4.xPatch availableCNA
  • QTS VendorQNAP Affected before 4.3.6.0895 Fixed in 4.3.6.0895 Patch available CNA
  • QTS VendorQNAP Affected before 4.3.4.0899 Fixed in 4.3.4.0899 Patch available CNA
  • QTS VendorQNAP Affected — Fixed in 4.5.x, 4.4.x Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*4.3.4 to before 4.3.4.0899; 4.3.5 to before 4.3.6.0895VulnerableQNAP
  • cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* Versions 4.3.4 to before 4.3.4.0899; 4.3.5 to before 4.3.6.0895 Vulnerable ·QNAP

Remediation

  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.3.6.0895
  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.3.4.0899
  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.5.x, 4.4.x

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-19945
  2. 2026-10-03 Alias added: GHSA-xc2v-fcxv-wj59

References

Advisory 1

  • TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
See all 282 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences