QNAP Systems vulnerabilities
595 CVEs and advisories name QNAP Systems as an affected vendor, 8 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-62841Hard-coded Cryptographic Key #2
- CVE-2025-62839Hard-coded Cryptographic Key #1
- CVE-2026-50619Unauthenticated remote code execution vulnerability
- CVE-2026-47790Privilege Escalation via QuFTP Log-based XSS
- CVE-2026-47786Pre-Authentication Command Injection
- CVE-2026-39997Unauthenticated Remote Input Injection in QNAP HD Station's remotepad
- CVE-2026-39991Stored Cross-Site Scripting (XSS) in Note Station file upload functionality
- CVE-2026-34009**Container Escape** Host user home directory mounted with write access into application container
- CVE-2026-34008**Privilege Escalation** World-writable crontab path monitored and executed by root-owned process
- CVE-2026-34007**RCE** Unsanitized `X-Forwarded-For` header passed to `shell_exec()` via broken IP validation fallback in `getClientIP()`
- CVE-2026-53882Path Traversal in Virtualization Station VM Import
- CVE-2026-50612Import Symlink Following Remote Code Execution Vulnerability in QuMagie
- CVE-2026-44084Access Code Forgery in Video Station leading to unauthorized media access
- CVE-2026-41545WebSocket timelapse path traversal and command injection
- CVE-2026-41541Symlink creation in qsyncsrv.cgi
- CVE-2026-39989SSRF in QNAP Download Station
- CVE-2026-34015Remote Code Execution in upload.php of Video Station
- CVE-2026-34014ds-move-files.sh is writable and executed as root
- CVE-2026-34006Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer
- CVE-2026-26245SQLi#2 SQL Injection in class_videos.php getSmartVideosByOffset
- CVE-2026-26244SQLi#1 SQL Injection in class_videos.php _getFilters
- CVE-2026-26243Arbitrary Folder Deletion in Qsync Central 5.0.0.5
- CVE-2026-41544Path Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/renameUpload endpoint
- CVE-2026-39993Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter
- CVE-2026-24723NULL Pointer Dereference in utilRequest.cgi
- CVE-2026-24722Null Pointer Dereference in File Station 5
- CVE-2026-24721Null Pointer Dereference in File Station 5
- CVE-2026-24718Path Traversal Vulnerability in Qsync Central's qsyncsrv.cgi
- CVE-2026-24715Lack of Reproducible Vulnerability Evidence in QNAP Report
- CVE-2026-22896Stored XSS via Interface Name in Network & Virtual Switch App