Path Traversal Vulnerability in QNAP Operating System

CVE-2025-30270

What is CVE-2025-30270?

A path traversal vulnerability has been identified in various versions of the QNAP operating system. This flaw allows a remote attacker, who possesses a valid user account, to exploit the vulnerability and access sensitive files or system data that should not be exposed. The malicious actor could potentially navigate outside of the restricted areas of the file system, leading to unauthorized disclosure of information. It is crucial for users to update to the patched versions QTS 5.2.5.3145 build 20250526 or later, and QuTS hero h5.2.5.3138 build 20250519 or later to mitigate the risk.

References