Skip to content
CVE PROGRAM SOURCE RECORD9.2 Critical

CVE-2025-66277

QTS, QuTS hero

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
qnap

Description

A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to traverse the file system to unintended locations. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3350 build 20251216 and later QuTS hero h5.3.2.3354 build 20251225 and later QuTS hero h5.2.8.3350 build 20251216 and later

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

QNAP Systems Inc. QTS

Default version status: unaffected

  • 5.2.x to < 5.2.8.3350 build 20251216affected

QNAP Systems Inc. QuTS hero

Default version status: unaffected

  • h5.3.x to < h5.3.2.3354 build 20251225affected
  • h5.2.x to < h5.2.8.3350 build 20251216affected

References