This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] QNAP fixes 27 vulnerabilities

QNAP fixes 27 vulnerabilities in various products; the most severe selected ones are described below. The remaining ones can be found at [1][2][3][4][5][6][7]. Products and their fixed versions: License Center - 2.0.36 [1] MARS (Multi-Application Recovery Service) - 1.2.1.1686 [2] Qfiling - 3.13.1 [3] Qfinder Pro (macOS) - 7.13.0 [4] Qsync (macOS) - 5.1.5 [4] QTS [5][6] - 5.2.7.3256 build 20250913 - 5.2.8.3332 build 20251128 QuTS hero [5][6] - h5.2.7.3256 build 20250913 - h5.2.8.3321 build 20251117 - h5.3.1.3250 build 20250912 QuMagie - 2.8.1 [7] QVPN Device Client (macOS) - 2.2.8 [4]

Multi-Application Recovery Service - SQL injection (CVE-2025-59387)
CVSS 8.1 (High)

An unauthenticated remote attacker can perform an SQL injection attack in MARS [2].

The vulnerability is present in product:

  • Multi-Application Recovery Service; >=1.2, <1.2.1.1686;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

More information:

  • CVE-2025-59387 at cve.org, NVD
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 2. 1. 2026.

Qfiling - unauthorized read/write (CVE-2025-59384)
CVSS 8.1 (High)

Under certain conditions, an unauthenticated remote attacker can read or modify potentially sensitive files and system data in Qfiling [3].

The vulnerability is present in product:

  • Qfiling; >=3.13, <3.13.1;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

More information:

  • CVE-2025-59384 at cve.org, NVD
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 2. 1. 2026.

QTS, QuTS hero - unauthorized read (CVE-2025-54164, CVE-2025-54165, CVE-2025-54166)
CVSS 4.6 (Medium)

An authenticated remote attacker with an administrator account can read potentially sensitive data beyond the allocated memory boundary [5].

The vulnerability is present in products:

  • QTS; >=5.2, <QTS 5.2.7.3256 build 20250913;
  • QuTS hero; >=h5.2, <h5.2.7.3256 build 20250913; >=h5.3, <h5.3.1.3250 build 20250912

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

More information:

The vulnerability was publicly disclosed 2. 1. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 7. 1. 2026.

CESNET, z.s.p.o. Logo