CVE-2025-66277
Analyzed Analyzed - Analysis Complete
Path Traversal Vulnerability in QNAP OS Allows Remote Access

Publication date: 2026-02-11

Last updated on: 2026-02-12

Assigner: QNAP Systems, Inc.

Description
A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to traverse the file system to unintended locations. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3350 build 20251216 and later QuTS hero h5.3.2.3354 build 20251225 and later QuTS hero h5.2.8.3350 build 20251216 and later
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-11
Last Modified
2026-02-12
Generated
2026-06-16
AI Q&A
2026-02-11
EPSS Evaluated
2026-06-15
NVD
CVE-2025-66277
Affected Vendors & Products
Showing 37 associated CPEs
Vendor Product Version / Range
qnap qts 5.2.0.2737
qnap qts 5.2.0.2744
qnap qts 5.2.0.2782
qnap qts 5.2.0.2802
qnap qts 5.2.0.2823
qnap qts 5.2.0.2851
qnap qts 5.2.0.2860
qnap qts 5.2.1.2930
qnap qts 5.2.2.2950
qnap qts 5.2.3.3006
qnap qts 5.2.4.3070
qnap qts 5.2.4.3079
qnap qts 5.2.4.3092
qnap qts 5.2.5.3145
qnap qts 5.2.6.3195
qnap qts 5.2.6.3229
qnap qts 5.2.7.3256
qnap qts 5.2.7.3297
qnap qts 5.2.8.3332
qnap quts_hero h5.2.0.2737
qnap quts_hero h5.2.0.2782
qnap quts_hero h5.2.0.2789
qnap quts_hero h5.2.0.2802
qnap quts_hero h5.2.0.2823
qnap quts_hero h5.2.0.2851
qnap quts_hero h5.2.0.2860
qnap quts_hero h5.2.1.2929
qnap quts_hero h5.2.1.2940
qnap quts_hero h5.2.2.2952
qnap quts_hero h5.2.3.3006
qnap quts_hero h5.2.4.3070
qnap quts_hero h5.2.4.3079
qnap quts_hero h5.2.5.3138
qnap quts_hero h5.2.6.3195
qnap quts_hero h5.2.7.3256
qnap quts_hero h5.2.7.3297
qnap quts_hero h5.2.8.3321
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a link following issue that affects several versions of QNAP operating systems. It allows remote attackers to exploit the system by traversing the file system to access unintended locations.

Impact Analysis

The vulnerability can allow remote attackers to access parts of the file system that should be restricted, potentially exposing sensitive data or system files. This can lead to unauthorized information disclosure or further exploitation of the system.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should update your QNAP operating system to the fixed versions.

  • Upgrade QTS to version 5.2.8.3350 build 20251216 or later.
  • Upgrade QuTS hero to version h5.3.2.3354 build 20251225 or later.
  • Upgrade QuTS hero to version h5.2.8.3350 build 20251216 or later.
Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-66277. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart