PT-2025-35290 · Qnap · Qsync Central

Coral · Published 2025-08-29 · Updated 2025-08-29 · CVE-2025-33038

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Qsync Central versions prior to 4.5.0.7

Description A path traversal vulnerability exists in Qsync Central. A remote attacker who has obtained a user account can exploit this issue to read the contents of unexpected files or system data.

Recommendations Update to Qsync Central version 4.5.0.7 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-33038

Affected Products

Qsync Central

References · 5

• https://osv.dev/vulnerability/CVE-2025-33038 · Vendor Advisory
• https://qnap.com/en/security-advisory/qsa-25-22 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-33038 · Security Note
• https://twitter.com/CVEnew/status/1961484491806920914 · Twitter Post
• https://t.me/CVEtracker/31266 · Telegram Post