A path traversal vulnerability has been reported to affect several product versions.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Jan 2, 2026 · NIST NVD

   Detected

   A path traversal vulnerability has been reported to affect several product versions. If a local attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: Qfinder Pro Mac 7.13.0 and later Qsync for Mac 5.1.5 and later QVPN Device Client for Mac 2.2.8 and later

2. Oct 14, 2026 · NIST NVD

   Updated

   A path traversal vulnerability has been reported to affect several product versions. If a local attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: Qfinder Pro Mac 7.13.0 and later Qsync for Mac 5.1.5 and later QVPN Device Client for Mac 2.2.8 and later

Sources

• CVE.orgVulnerability recordCVE-2025-53594

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-53594

  30-day exploitation probability 0.1%

  first.org
• NIST NVDVulnerability recordCVE-2025-53594

  A path traversal vulnerability has been reported to affect several product versions. If a local attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the followin

  nvd.nist.gov

References

• Reference · qnap.com