Cross-Site Scripting Vulnerability in QuFTP Service by QNAP
CVE-2026-22895

2.2LOW

Key Information:

Vendor

QNAP
Status
Quftp Service
Vendor
CVE Published:
20 March 2026

What is CVE-2026-22895?

A Cross-Site Scripting vulnerability has been identified in QuFTP Service, allowing a remote attacker with an administrator account to exploit the flaw. This could lead to the bypass of important security measures or unauthorized access to sensitive application data. To safeguard against this vulnerability, ensure you are running QuFTP Service version 1.4.3 or later, as subsequent updates have addressed these security risks.

Affected Version(s)

QuFTP Service 1.4.x < 1.4.3

QuFTP Service 1.5.x < 1.5.2

QuFTP Service 1.6.x < 1.6.2

References

https://www.qnap.com/en/security-advisory/qsa-26-15

CVSS V4

Score:
2.2
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Milan Solanki (LeoSecurity)
.