CVE-2026-41544
8.7HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-22
Impact
Authenticated remote attackers can read arbitrary system files or data on the host. They need valid user credentials on the affected device to exploit it.
Root cause
Improper limitation of a pathname to a restricted directory (path traversal) in QcalAgent.
Affected systems
QcalAgent versions prior to 1.1.10
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade QcalAgent to version 1.1.10 or later via the QNAP App Center. If patching immediately is not possible, disable or stop the QcalAgent application.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.10 and later