CVE-2026-41541
An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central.
Published Oct 15, 2026 · updated Oct 15, 2026 · QNAP Systems Inc. Qsync Central
An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central
Oct 15, 2026 · NIST NVD
Updated
An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central
Affected
- vendor QNAP Systems Inc. Qsync Centralversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-41541
An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-41541
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-41541
30-day exploitation probability 0.5%
first.org - NIST NVDVulnerability recordCVE-2026-41541
An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the followin
nvd.nist.gov