CVE-2026-50619

9.3Critical

Published 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

9.3Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-22

Impact

Remote, unauthenticated attackers can read arbitrary system files and confidential data over the network. They require only network access to the Qsirch application.

Root cause

Improper input validation allows path traversal (CWE-22) outside the intended directory structure.

Affected systems

Qsirch versions prior to 7.0.3.0.

CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Upgrade Qsirch to version 7.0.3.0 or later via the QTS App Center. If patching immediately is not possible, stop or disable the Qsirch service or restrict network access to the NAS management interface.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsirch 7.0.3.0 and later

References

https://www.qnap.com/en/app-release-notes?keyword=Qsirch&app=Qsirch&product-line=nas

Source: nvd.nist.gov/vuln/detail/CVE-2026-50619