Path Traversal Vulnerability in QNAP Operating System
CVE-2025-47211

6.9MEDIUM

Key Information:

Vendor

QNAP
Status
Qts
Quts Hero
Vendor
CVE Published:
3 October 2025

What is CVE-2025-47211?

A path traversal vulnerability has been identified in QNAP's operating system, allowing a remote attacker with administrator credentials to traverse directories and access sensitive files or system data that should remain protected. This weakness highlights the importance of securing admin accounts and keeping software updated. QNAP has released fixes in version 5.2.6.3195 build 20250715 and later for both QTS and QuTS hero systems.

Affected Version(s)

QTS 5.2.x < 5.2.6.3195 build 20250715

QuTS hero h5.2.x

References

https://www.qnap.com/en/security-advisory/qsa-25-36

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

coral
JSON
.
CVE-2025-47211 : Path Traversal Vulnerability in QNAP Operating System