Read the docs
TI-2025-36940 Aliases CVE-2025-59381GHSA-fj3g-cqvg-f3jx

Path traversal in QNAP QTS

Priority LOW 31CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3332 build 20251128 and later QuTS hero h5.2.8.3321 build 20251117 and later QuTS hero h5.3.2.3354 build 20251225 and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00466 40th percentileScored 2026-11-07
Fix Fixed QTS (QNAP Systems Inc.): 5.2.8.3332 build 20251128QuTS hero (QNAP Systems Inc.): h5.2.8.3321 build 20251117, h5.3.2.3354 build 20251225

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPQTS5.2.0 to before 5.2.8.3332 build 202511285.2.8.3332 build 20251128Patch availableCNA
QNAPQuTS heroh5.2.0 to before h5.2.8.3321 build 20251117; h5.3.0 to before h5.3.2.3354 build 20251225h5.2.8.3321 build 20251117, h5.3.2.3354 build 20251225Patch availableCNA
  • QTS VendorQNAP Affected 5.2.0 to before 5.2.8.3332 build 20251128 Fixed in 5.2.8.3332 build 20251128 Patch available CNA
  • QuTS hero VendorQNAP Affected h5.2.0 to before h5.2.8.3321 build 20251117; h5.3.0 to before h5.3.2.3354 build 20251225 Fixed in h5.2.8.3321 build 20251117, h5.3.2.3354 build 20251225 Patch available CNA

CPE configurations NVD · 38

CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:*5.2.0.2737 build_20240417VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:*5.2.0.2744 build_20240424VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:*5.2.0.2782 build_20240601VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:*5.2.0.2802 build_20240620VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:*5.2.0.2823 build_20240711VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:*5.2.0.2851 build_20240808VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:*5.2.0.2860 build_20240817VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:*5.2.1.2930 build_20241025VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:*5.2.2.2950 build_20241114VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:*5.2.3.3006 build_20250108VulnerableQNAP
  • cpe:2.3:o:qnap:qts:5.2.0.2737:build_20240417:*:*:*:*:*:* Versions 5.2.0.2737 build_20240417 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.0.2744:build_20240424:*:*:*:*:*:* Versions 5.2.0.2744 build_20240424 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.0.2782:build_20240601:*:*:*:*:*:* Versions 5.2.0.2782 build_20240601 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.0.2802:build_20240620:*:*:*:*:*:* Versions 5.2.0.2802 build_20240620 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.0.2823:build_20240711:*:*:*:*:*:* Versions 5.2.0.2823 build_20240711 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.0.2851:build_20240808:*:*:*:*:*:* Versions 5.2.0.2851 build_20240808 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.0.2860:build_20240817:*:*:*:*:*:* Versions 5.2.0.2860 build_20240817 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.1.2930:build_20241025:*:*:*:*:*:* Versions 5.2.1.2930 build_20241025 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.2.2950:build_20241114:*:*:*:*:*:* Versions 5.2.2.2950 build_20241114 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.3.3006:build_20250108:*:*:*:*:*:* Versions 5.2.3.3006 build_20250108 Vulnerable ·QNAP
Show 28 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:*5.2.4.3070 build_20250312VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:*5.2.4.3079 build_20250321VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:*5.2.4.3092 build_20250403VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.5.3145:build_20250526:*:*:*:*:*:*5.2.5.3145 build_20250526VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.6.3195:build_20250715:*:*:*:*:*:*5.2.6.3195 build_20250715VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.6.3229:build_20250818:*:*:*:*:*:*5.2.6.3229 build_20250818VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.7.3256:build_20250913:*:*:*:*:*:*5.2.7.3256 build_20250913VulnerableQNAP
cpe:2.3:o:qnap:qts:5.2.7.3297:build_20251024:*:*:*:*:*:*5.2.7.3297 build_20251024VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:*h5.2.0.2737 build_20240417VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:*h5.2.0.2782 build_20240601VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:*h5.2.0.2789 build_20240607VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:*h5.2.0.2802 build_20240620VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:*h5.2.0.2823 build_20240711VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:*h5.2.0.2851 build_20240808VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:*h5.2.0.2860 build_20240817VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:*h5.2.1.2929 build_20241025VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:*h5.2.1.2940 build_20241105VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:*h5.2.2.2952 build_20241116VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:*h5.2.3.3006 build_20250108VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:*h5.2.4.3070 build_20250312VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:*h5.2.4.3079 build_20250321VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.5.3138:build_20250519:*:*:*:*:*:*h5.2.5.3138 build_20250519VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.6.3195:build_20250715:*:*:*:*:*:*h5.2.6.3195 build_20250715VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.7.3256:build_20250913:*:*:*:*:*:*h5.2.7.3256 build_20250913VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.2.7.3297:build_20251024:*:*:*:*:*:*h5.2.7.3297 build_20251024VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.3.0.3115:build_20250430:*:*:*:*:*:*h5.3.0.3115 build_20250430VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.3.0.3145:build_20250530:*:*:*:*:*:*h5.3.0.3145 build_20250530VulnerableQNAP
cpe:2.3:o:qnap:quts_hero:h5.3.0.3192:build_20250716:*:*:*:*:*:*h5.3.0.3192 build_20250716VulnerableQNAP
  • cpe:2.3:o:qnap:qts:5.2.4.3070:build_20250312:*:*:*:*:*:* Versions 5.2.4.3070 build_20250312 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.4.3079:build_20250321:*:*:*:*:*:* Versions 5.2.4.3079 build_20250321 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.4.3092:build_20250403:*:*:*:*:*:* Versions 5.2.4.3092 build_20250403 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.5.3145:build_20250526:*:*:*:*:*:* Versions 5.2.5.3145 build_20250526 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.6.3195:build_20250715:*:*:*:*:*:* Versions 5.2.6.3195 build_20250715 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.6.3229:build_20250818:*:*:*:*:*:* Versions 5.2.6.3229 build_20250818 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.7.3256:build_20250913:*:*:*:*:*:* Versions 5.2.7.3256 build_20250913 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:qts:5.2.7.3297:build_20251024:*:*:*:*:*:* Versions 5.2.7.3297 build_20251024 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.0.2737:build_20240417:*:*:*:*:*:* Versions h5.2.0.2737 build_20240417 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.0.2782:build_20240601:*:*:*:*:*:* Versions h5.2.0.2782 build_20240601 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.0.2789:build_20240607:*:*:*:*:*:* Versions h5.2.0.2789 build_20240607 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.0.2802:build_20240620:*:*:*:*:*:* Versions h5.2.0.2802 build_20240620 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.0.2823:build_20240711:*:*:*:*:*:* Versions h5.2.0.2823 build_20240711 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.0.2851:build_20240808:*:*:*:*:*:* Versions h5.2.0.2851 build_20240808 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.0.2860:build_20240817:*:*:*:*:*:* Versions h5.2.0.2860 build_20240817 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.1.2929:build_20241025:*:*:*:*:*:* Versions h5.2.1.2929 build_20241025 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.1.2940:build_20241105:*:*:*:*:*:* Versions h5.2.1.2940 build_20241105 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.2.2952:build_20241116:*:*:*:*:*:* Versions h5.2.2.2952 build_20241116 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.3.3006:build_20250108:*:*:*:*:*:* Versions h5.2.3.3006 build_20250108 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.4.3070:build_20250312:*:*:*:*:*:* Versions h5.2.4.3070 build_20250312 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.4.3079:build_20250321:*:*:*:*:*:* Versions h5.2.4.3079 build_20250321 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.5.3138:build_20250519:*:*:*:*:*:* Versions h5.2.5.3138 build_20250519 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.6.3195:build_20250715:*:*:*:*:*:* Versions h5.2.6.3195 build_20250715 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.7.3256:build_20250913:*:*:*:*:*:* Versions h5.2.7.3256 build_20250913 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.2.7.3297:build_20251024:*:*:*:*:*:* Versions h5.2.7.3297 build_20251024 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.3.0.3115:build_20250430:*:*:*:*:*:* Versions h5.3.0.3115 build_20250430 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.3.0.3145:build_20250530:*:*:*:*:*:* Versions h5.3.0.3145 build_20250530 Vulnerable ·QNAP
  • cpe:2.3:o:qnap:quts_hero:h5.3.0.3192:build_20250716:*:*:*:*:*:* Versions h5.3.0.3192 build_20250716 Vulnerable ·QNAP

Remediation

  • Fix · CNA QTS (QNAP Systems Inc.) Fixed in 5.2.8.3332 build 20251128
  • Fix · CNA QuTS hero (QNAP Systems Inc.) Fixed in h5.2.8.3321 build 20251117, h5.3.2.3354 build 20251225

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    QNAP Systems QTS 5.2.8.3332 build 20251128

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2025-36939 Path traversal in QNAP QTSPriority LOW 22
    • TI-2025-08352 An exposure of sensitive system information to an unauthorized control sphere…Priority LOW 14
    • TI-2025-39005 QTS, QuTS heroPriority LOW 8
    Show all 5 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59381
  2. 2026-10-03 Alias added: GHSA-fj3g-cqvg-f3jx

References

Advisory 1

  • TI-2020-02221 Command Injection Vulnerability in QTS and QuTS hero KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05101 Improper input validation in QNAP NAS devices KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14137 Improper input validation in QNAP QTS KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-14131 Cross-site scripting in QNAP QTS KEVCVSS 3.1HIGH 8.0
See all 282 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences