CVE-2025-59381
A path traversal vulnerability has been reported to affect several QNAP operating system versions.
Published Jan 2, 2026 · updated Oct 14, 2026 · qnap qts
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3332 build 20251128 and later QuTS hero h5.2.8.3321 build 20251117 and later QuTS hero h5.3.2.3354 build 20251225 and later
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Jan 2, 2026 · NIST NVD
Detected
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3332 build 20251128 and later QuTS hero h5.2.8.3321 build 20251117 and lat
Oct 14, 2026 · NIST NVD
Updated
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3332 build 20251128 and later QuTS hero h5.2.8.3321 build 20251117 and lat
Affected
- cpe qnap/qts5.2.0.2737
- cpe qnap/qts5.2.0.2744
- cpe qnap/qts5.2.0.2782
- cpe qnap/qts5.2.0.2802
- cpe qnap/qts5.2.0.2823
- cpe qnap/qts5.2.0.2851
- cpe qnap/qts5.2.0.2860
- cpe qnap/qts5.2.1.2930
- cpe qnap/quts heroh5.2.0.2737
Sources
- CVE.orgVulnerability recordCVE-2025-59381
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2025-59381
30-day exploitation probability 0.5%
first.org - NIST NVDVulnerability recordCVE-2025-59381
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vuln
nvd.nist.gov