Read the docs
TI-2021-19801 Aliases CVE-2021-44052GHSA-q4mx-gr8m-q3rr

Arbitrary file read in QNAP QuTScloud

Priority LOW 38CWE-59Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

An improper link resolution before file access ('Link Following') vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, and QTS. If exploited, this vulnerability allows remote attackers to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero, and QTS: QuTScloud c5.0.1.1998 and later QuTS hero h4.5.4.1971 build 20220310 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 4.3.4.1976 build 20220303 and later QTS 4.3.3.1945 build 20220303 and later QTS 4.2.6 build 20220304 and later QTS 4.3.6.1965 build 20220302 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later

Why it matters now

EPSS 0.01591 75th percentileScored 2026-11-07
Fix Fixed QuTScloud (QNAP Systems Inc.): c5.0.1.1998QuTS hero (QNAP Systems Inc.): h4.5.4.1971 build 20220310, h5.0.0.1986 build 20220324+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQuTScloudbefore c5.0.1.1998c5.0.1.1998Patch availableCNA
QNAPQuTS herobefore h4.5.4.1971 build 20220310; before h5.0.0.1986 build 20220324h4.5.4.1971 build 20220310, h5.0.0.1986 build 20220324Patch availableCNA
QNAPQTSbefore 4.3.4.1976 build 20220303; before 4.3.3.1945 build 20220303; before 4.2.6 build 20220304; before 4.3.6.1965 build 20220302; before 5.0.0.1986 build 20220324; before 4.5.4.1991 build 202203294.3.4.1976 build 20220303, 4.3.3.1945 build 20220303, 4.2.6 build 20220304, 4.3.6.1965 build 20220302, 5.0.0.1986 build 20220324, 4.5.4.1991 build 20220329Patch availableCNA
  • QuTScloud VendorQNAP Affected before c5.0.1.1998 Fixed in c5.0.1.1998 Patch available CNA
  • QuTS hero VendorQNAP Affected before h4.5.4.1971 build 20220310; before h5.0.0.1986 build 20220324 Fixed in h4.5.4.1971 build 20220310, h5.0.0.1986 build 20220324 Patch available CNA
  • QTS VendorQNAP Affected before 4.3.4.1976 build 20220303; before 4.3.3.1945 build 20220303; before 4.2.6 build 20220304; before 4.3.6.1965 build 20220302; before 5.0.0.1986 build 20220324; before 4.5.4.1991 build 20220329 Fixed in 4.3.4.1976 build 20220303, 4.3.3.1945 build 20220303, 4.2.6 build 20220304, 4.3.6.1965 build 20220302, 5.0.0.1986 build 20220324, 4.5.4.1991 build 20220329 Patch available CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:qnap:qts:*:*:*:*:*:*:*:*5.0.0.1716 to before 5.0.0.1986VulnerableQNAP
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*4.3.3.0174 to before 4.3.3.1945; 4.3.4.0899 to before 4.3.4.1976; 4.3.6.0895 to before 4.3.6.1965; 4.4.0.0883 to before 4.5.4.1991VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:*4.2.6 build_20170517VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:*4.2.6 build_20190322VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:*4.2.6 build_20190730VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:*4.2.6 build_20190921VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:*4.2.6 build_20191107VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:*4.2.6 build_20200109VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:*4.2.6 build_20200421VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:*4.2.6 build_20200611VulnerableQNAP
  • cpe:2.3:a:qnap:qts:*:*:*:*:*:*:*:* Versions 5.0.0.1716 to before 5.0.0.1986 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* Versions 4.3.3.0174 to before 4.3.3.1945; 4.3.4.0899 to before 4.3.4.1976; 4.3.6.0895 to before 4.3.6.1965; 4.4.0.0883 to before 4.5.4.1991 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20170517:*:*:*:*:*:* Versions 4.2.6 build_20170517 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190322:*:*:*:*:*:* Versions 4.2.6 build_20190322 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190730:*:*:*:*:*:* Versions 4.2.6 build_20190730 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20190921:*:*:*:*:*:* Versions 4.2.6 build_20190921 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20191107:*:*:*:*:*:* Versions 4.2.6 build_20191107 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200109:*:*:*:*:*:* Versions 4.2.6 build_20200109 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200421:*:*:*:*:*:* Versions 4.2.6 build_20200421 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200611:*:*:*:*:*:* Versions 4.2.6 build_20200611 Vulnerable ·QNAP
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:*4.2.6 build_20200821VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20210327:*:*:*:*:*:*4.2.6 build_20210327VulnerableQNAP
cpe:2.3:o:qnap:qts:4.2.6:build_20211215:*:*:*:*:*:*4.2.6 build_20211215VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:*before h4.5.4.1771; h5.0.0.1772 to before h5.0.0.1986VulnerableQNAP
cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:*before c5.0.1.1998VulnerableQNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20200821:*:*:*:*:*:* Versions 4.2.6 build_20200821 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20210327:*:*:*:*:*:* Versions 4.2.6 build_20210327 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:4.2.6:build_20211215:*:*:*:*:*:* Versions 4.2.6 build_20211215 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:*:*:*:*:*:*:*:* Versions before h4.5.4.1771; h5.0.0.1772 to before h5.0.0.1986 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qutscloud:*:*:*:*:*:*:*:* Versions before c5.0.1.1998 Vulnerable ·QNAP

Remediation

  • Fix · CNA QuTScloud (QNAP Systems Inc.) Fixed in c5.0.1.1998
  • Fix · CNA QuTS hero (QNAP Systems Inc.) Fixed in h4.5.4.1971 build 20220310, h5.0.0.1986 build 20220324
  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 4.3.4.1976 build 20220303, 4.3.3.1945 build 20220303, 4.2.6 build 20220304, 4.3.6.1965 build 20220302, 5.0.0.1986 build 20220324, 4.5.4.1991 build 20220329

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    QNAP Systems QuTS hero h4.5.4.1971 build 20220310, h5.0.0.1986 build 20220324

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-44052
  2. 2026-10-03 Alias added: GHSA-q4mx-gr8m-q3rr

References

Advisory 1

  • TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
See all 282 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences