PT-2026-1097 · Qnap · Quts Hero+1

Coral · Published 2026-01-02 · Updated 2026-01-06 · CVE-2025-59381

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions QNAP versions prior to QTS 5.2.8.3332 build 20251128 QNAP versions prior to QuTS hero h5.2.8.3321 build 20251117

Description A path traversal issue exists in QNAP operating systems. A remote attacker with administrator privileges can potentially read the contents of arbitrary files or system data.

Recommendations Update QTS to version 5.2.8.3332 build 20251128 or later. Update QuTS hero to version h5.2.8.3321 build 20251117 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-59381

Affected Products

Qts

Quts Hero

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-59381 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59381 · Vendor Advisory
• https://qnap.com/en/security-advisory/qsa-25-51 · Vendor Advisory
• https://twitter.com/CVEnew/status/2007118418294779927 · Twitter Post
• https://t.me/cveNotify/147822 · Telegram Post