Path Traversal Vulnerability in QNAP Operating System
CVE-2025-30271

5.3MEDIUM

Key Information:

Vendor

QNAP
Status
Qts
Quts Hero
Vendor
CVE Published:
29 August 2025

What is CVE-2025-30271?

A path traversal vulnerability has been identified in the QNAP operating system that could allow an attacker with a user account to access sensitive files or system data that should not be exposed. By exploiting this vulnerability, remote attackers could read unexpected files, potentially jeopardizing user data confidentiality and system integrity. Users are strongly recommended to upgrade to QTS 5.2.5.3145 build 20250526 or later, and QuTS hero h5.2.5.3138 build 20250519 or later to mitigate the risks associated with this security flaw.

Affected Version(s)

QTS 5.2.x < 5.2.5.3145 build 20250526

QuTS hero h5.2.x

References

https://www.qnap.com/en/security-advisory/qsa-25-21

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

coral
.
CVE-2025-30271 : Path Traversal Vulnerability in QNAP Operating System