PT-2025-35289 · Qnap · Qsync Central

Coral · Published 2025-08-29 · Updated 2025-08-29 · CVE-2025-33037

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Qsync Central versions prior to 4.5.0.7

Description A path traversal vulnerability exists in Qsync Central. A remote attacker who has gained a user account can exploit this vulnerability to read the contents of unexpected files or system data.

Recommendations Update to Qsync Central version 4.5.0.7 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-33037

Affected Products

Qsync Central

References · 5

• https://osv.dev/vulnerability/CVE-2025-33037 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-33037 · Security Note
• https://qnap.com/en/security-advisory/qsa-25-22 · Vendor Advisory
• https://t.me/CVEtracker/31265 · Telegram Post
• https://twitter.com/CVEnew/status/1961484493006438910 · Twitter Post