This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] QNAP fixes 17 vulnerabilities
QNAP fixes 17 vulnerabilities in its products. Selected vulnerabilities are described below, the remaining ones can be found at [1][2]. Products and their fixed versions: QuMagie - 2.9.1, 2.10.0 [1] License Center - 2.0.42 [1] QVP - 2.8.0 [2] QTS - 5.2.10 [2] QuTS cloud - C5.2.9 [2] QuTS hero - h5.2.9 [2]
An unauthenticated remote attacker can access stored media files and album archives, and thereby obtain sensitive information, due to insufficient access control in the QuMagie application [1].
The vulnerability is present in product:
- QuMagie; >=2.8.2, <2.9.1; >=2.9.0, <2.10.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-44083 at cve.org, NVD
- CWE-639: Authorization Bypass Through User-Controlled Key at cwe.mitre.org
The vulnerability was publicly disclosed 10. 6. 2026.
An unauthenticated remote attacker can access stored media files, and thereby obtain sensitive information, due to insufficient pre-authentication access control in the QuMagie application [1].
The vulnerability is present in product:
- QuMagie; >=2.8.2, <2.9.1; >=2.9.0, <2.10.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2026-26236 at cve.org, NVD
- CWE-862: Missing Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 10. 6. 2026.
An unauthenticated remote attacker can gain access to thumbnails of recognized faces and folder cover images, and thereby obtain sensitive information, due to insufficient pre-authentication access control in the QuMagie application [3].
The vulnerability is present in product:
- QuMagie; >=2.8.2, <2.9.1; >=2.9.0, <2.10.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2026-26237 at cve.org, NVD
- CWE-862: Missing Authorization at cwe.mitre.org
- CWE-359: Exposure of Private Personal Information to an Unauthorized Actor at cwe.mitre.org
The vulnerability was publicly disclosed 10. 6. 2026.
An authenticated remote attacker with administrator privileges can execute arbitrary system commands on the NAS device via command injection due to insufficient validation of the username parameter [2].
The vulnerability is present in products:
- QVP; >=2.7.1, <2.8.0
- QTS; >=5.2.7, <5.2.10
- QuTS cloud; >=c5.2.8, <c5.2.9
- QuTS hero; >=h5.2.8, <h5.2.9
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-66273 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 6. 6. 2026.
An authenticated remote attacker with administrator privileges can execute arbitrary system commands on the NAS device via command injection in the user deletion API [2].
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-66279 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 6. 6. 2026.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 17. 6. 2026.