Improper Link Resolution Vulnerability in QNAP Virtualization Station
CVE-2026-53882

8.7HIGH

Key Information:

Vendor

QNAP
Status
Virtualization Station
Vendor
CVE Published:
15 October 2026

What is CVE-2026-53882?

A vulnerability exists in QNAP's Virtualization Station that allows for improper link resolution before file access, commonly referred to as 'link following.' If a remote attacker is able to obtain a user account, they can exploit this weakness to potentially compromise the system's security. It is critical for users to update to Virtualization Station version 4.1.1.130 or later to mitigate any risks associated with this vulnerability.

Affected Version(s)

Virtualization Station 4.1.x < 4.1.1.130

References

https://www.qnap.com/en/app_releasenotes/list.php?app_cho...
release-notes

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

JUNYI LIU
.