This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] QNAP fixes 47 vulnerabilities in various products
QNAP fixes 47 vulnerabilities in various products, the most severe of which are described below. The remaining ones can be found at [1][2][3][4][5][6][7]. Products and their fixed versions: Media Streaming add-on - 500.1.1.6 [1] Qsync Central - 5.0.0.4 [2] File Station 5 - 5.5.6.5190 [3] QTS - 5.2.8.3350 build 20251216 [4][5][7] QuTS hero [4][5][6][7] - h5.2.8.3350 build 20251216 - h5.3.2.3354 build 20251225
Due to a flaw in the handling of file links, an unauthenticated remote attacker can access files outside the permitted locations in the QNAP QTS and QuTS hero operating systems [5].
The vulnerability is present in products:
- QTS; >=h5.2.0, <h5.2.8.3350 build 20251216;
- QuTS hero; >=h5.2.0, <h5.2.8.3350 build 20251216; >=h5.3.0, <h5.3.2.3354 build 20251225;
CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
More information:
- CVE-2025-66277 at cve.org, NVD
- CWE-59: Improper Link Resolution Before File Access ('Link Following') at cwe.mitre.org
The vulnerability was publicly disclosed 12. 2. 2026.
Due to a flaw in the Apache HTTP Server component under a specific configuration, an unauthenticated remote attacker can trigger SSRF in the QNAP QTS and QuTS hero operating systems [4].
The vulnerability is present in products:
- QTS; >=5.2.0, <5.2.8.3332 build 20251128;
- QuTS hero; >=h5.2.0, <h5.2.8.3321 build 20251117; >=h5.3.0, <h5.3.2.3354 build 20251225;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
More information:
- CVE-2024-43204 at cve.org, NVD
- CWE-918: Server-Side Request Forgery (SSRF) at cwe.mitre.org
The vulnerability was publicly disclosed 12. 2. 2026.
Due to insufficient control over the allocation of system resources, an authenticated local attacker can exhaust available resources in Qsync Central, which may lead to a DoS attack [2].
The vulnerability is present in product:
- Qsync Central; >=5.0.0, <5.0.0.4
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
More information:
- CVE-2025-54149 at cve.org, NVD
- CVE-2025-54150 at cve.org, NVD
- CVE-2025-54151 at cve.org, NVD
- CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org
- CWE-400: Uncontrolled Resource Consumption at cwe.mitre.org
- CWE-789: Memory Allocation with Excessive Size Value at cwe.mitre.org
The vulnerability was publicly disclosed 12. 2. 2026.
Due to insufficient input handling in the Samba component of the QTS and QuTS hero operating systems, an unauthenticated remote attacker can remotely execute arbitrary commands on the system [7]. We reported on the fix for this vulnerability in the Samba project earlier [8].
The vulnerability is present in products:
- QTS; >=5.2.0, <5.2.8.3332 build 20251128
- QuTS hero; >=h5.2.0, <h5.2.8.3321 build 20251117; >=h5.3.0, <h5.3.2.3354 build 20251225
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2025-10230 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 12. 2. 2026.
Links
- [1] https://www.qnap.com/en/security-advisory/qsa-25-57
- [2] https://www.qnap.com/en/security-advisory/qsa-26-02
- [3] https://www.qnap.com/en/security-advisory/qsa-26-03
- [4] https://www.qnap.com/en/security-advisory/qsa-26-04
- [5] https://www.qnap.com/en/security-advisory/qsa-26-05
- [6] https://www.qnap.com/en/security-advisory/qsa-26-08
- [7] https://www.qnap.com/en/security-advisory/qsa-26-06
- [8] https://cyberfeed.cesnet.cz/reports/699
By CESNET, z.s.p.o. Henrieta Paločková on 16. 2. 2026.