CVE-2026-26243
7.2HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on integrity, availability
- Weakness
- CWE-22
Impact
Authenticated attackers can read arbitrary files and system data over the network. They need valid user credentials on the target NAS first.
Root cause
Improper input validation in Qsync Central allows path traversal (CWE-22) outside intended directories.
Affected systems
Qsync Central versions prior to 5.0.0.6, 5.1.0.2, and 5.2.0.4.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Update Qsync Central to version 5.0.0.6, 5.1.0.2, 5.2.0.4, or later via the QNAP App Center; if updating must wait, disable the Qsync Central app or restrict network access to trusted users.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.6 and later Qsync Central 5.1.0.2 and later Qsync Central 5.2.0.4 and later