Read the docs
TI-2021-16264 Aliases CVE-2021-38693GHSA-cj82-5f36-ppxw

Path Traversal in thttpd

Priority LOW 26CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

A path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance. If exploited, this vulnerability allows attackers to read the contents of unexpected files and expose sensitive data. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero, QTS, QVR Pro Appliance: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero h4.5.4.1951 build 20220218 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later

Why it matters now

EPSS 0.00951 61st percentileScored 2026-11-07
Fix Fixed QuTScloud (QNAP Systems Inc.): c5.0.1.1949QuTS hero (QNAP Systems Inc.): h5.0.0.1949 build 20220215, h4.5.4.1951 build 20220218+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQuTScloudbefore c5.0.1.1949c5.0.1.1949Patch availableCNA
QNAPQuTS herobefore h5.0.0.1949 build 20220215; before h4.5.4.1951 build 20220218h5.0.0.1949 build 20220215, h4.5.4.1951 build 20220218Patch availableCNA
QNAPQTSbefore 5.0.0.1986 build 20220324; before 4.5.4.1991 build 202203295.0.0.1986 build 20220324, 4.5.4.1991 build 20220329Patch availableCNA
  • QuTScloud VendorQNAP Affected before c5.0.1.1949 Fixed in c5.0.1.1949 Patch available CNA
  • QuTS hero VendorQNAP Affected before h5.0.0.1949 build 20220215; before h4.5.4.1951 build 20220218 Fixed in h5.0.0.1949 build 20220215, h4.5.4.1951 build 20220218 Patch available CNA
  • QTS VendorQNAP Affected before 5.0.0.1986 build 20220324; before 4.5.4.1991 build 20220329 Fixed in 5.0.0.1986 build 20220324, 4.5.4.1991 build 20220329 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*before 4.5.4.1991; 5.0.0.1716 to before 5.0.0.1986VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*h5.0.0.1772 to before h5.0.0.1949VulnerableQNAP
cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*before c5.0.1.1949VulnerableQNAP
  • cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* Versions before 4.5.4.1991; 5.0.0.1716 to before 5.0.0.1986 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:* Versions h5.0.0.1772 to before h5.0.0.1949 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:* Versions before c5.0.1.1949 Vulnerable ·QNAP

Remediation

  • Fix · CNA QuTScloud (QNAP Systems Inc.) Fixed in c5.0.1.1949
  • Fix · CNA QuTS hero (QNAP Systems Inc.) Fixed in h5.0.0.1949 build 20220215, h4.5.4.1951 build 20220218
  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 5.0.0.1986 build 20220324, 4.5.4.1991 build 20220329

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    QNAP Systems QuTScloud c5.0.1.1949

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    Show all 4 records →
  • Release ·

    QNAP Systems QTS 4.5.4.1991 build 20220329, 5.0.0.1986 build 20220324

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    Show all 3 records →
Show 1 more group
  • Release ·

    QNAP Systems QuTS hero h4.5.4.1951 build 20220218, h5.0.0.1949 build 20220215

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-38693
  2. 2026-10-03 Alias added: GHSA-cj82-5f36-ppxw

References

Advisory 1

  • TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
See all 282 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences