Path Traversal Vulnerability in QcalAgent by QNAP
CVE-2026-41544

8.7HIGH

Key Information:

Vendor

QNAP
Status
Qcalagent
Vendor
CVE Published:
15 October 2026

What is CVE-2026-41544?

A path traversal vulnerability has been identified in QcalAgent, allowing remote attackers with user accounts to exploit the system. This can enable them to access and read contents of unexpected files or sensitive system data. To mitigate this issue, it is critical to update to QcalAgent version 1.1.10 or later where the vulnerability has been addressed.

Affected Version(s)

QcalAgent 1.1.x < 1.1.10

References

https://www.qnap.com/en/app-release-notes?keyword=QcalAge...
release-notes

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ahmad Mamdouh
.