PT-2026-1098 · Qfiling · Qfiling

Long Hà · Published 2026-01-02 · Updated 2026-01-07 · CVE-2025-59384

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qfiling versions prior to 3.13.1

Description A path traversal issue exists in Qfiling that could allow remote attackers to read the contents of unexpected files or system data. Approximately 3257k+ instances are potentially exposed. The vulnerability allows access to files outside the intended directory through manipulation of file paths.

Recommendations Update Qfiling to version 3.13.1 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2026-00812

CVE-2025-59384

Affected Products

Qfiling

References · 9

• https://qnap.com/en/security-advisory/qsa-25-54 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59384 · Security Note
• https://bdu.fstec.ru/vul/2026-00812 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59384 · Vendor Advisory
• https://reddit.com/r/CVEWatch/comments/1q5fnjl/top_10_trending_cves_06012026 · Reddit Post
• https://t.me/CVEtracker/41253 · Telegram Post
• https://twitter.com/zoomeye_team/status/2008062972405653894 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1q6cj0c/top_10_trending_cves_07012026 · Reddit Post
• https://twitter.com/CVEnew/status/2007118417376231468 · Twitter Post