Path Traversal Vulnerability in Qsync Central by QNAP

CVE-2026-26243

What is CVE-2026-26243?

A path traversal vulnerability has been identified in Qsync Central, a product by QNAP, enabling remote attackers with legitimate user accounts to exploit the system. This vulnerability allows unauthorized access to read sensitive files or system data that would otherwise remain protected. To mitigate the risks associated with this vulnerability, users are strongly encouraged to update to Qsync Central version 5.0.0.6 or later, 5.1.0.2 or later, or 5.2.0.4 or later, which includes the necessary security fixes.

References