CVE-2026-24717

Modified Modified - Updated After Analysis

Path Traversal in QNAP QTS and QuTS hero

Publication date: 2026-06-10

Last updated on: 2026-06-30

Assigner: QNAP Systems, Inc.

Description

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3459 build 20260409 and later

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-30

Generated

2026-06-30

AI Q&A

2026-06-10

EPSS Evaluated

2026-06-29

NVD

CVE-2026-24717

EUVD

EUVD-2026-35976

Affected Vendors & Products

Vendor	Product	Version / Range
qnap	qts	From 5.2.0.2737 (inc) to 5.2.9.3492 (exc)
qnap	quts_hero	From h5.0.0 (inc) to h5.2.9.3499 (exc)
qnap	quts_hero	From h5.3.0.3115 (inc) to h5.3.4.3500 (exc)
qnap	quts_hero	From h6.0.0.3324 (inc) to h6.0.0.3459 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue affecting several QNAP operating system versions. It allows a remote attacker who has already obtained an administrator account to exploit the vulnerability and read the contents of files or system data that they should not normally have access to.

Impact Analysis

If exploited, this vulnerability can allow an attacker with administrator privileges to access sensitive or unexpected files and system data. This could lead to unauthorized disclosure of confidential information, potential data breaches, and compromise of system integrity.

Mitigation Strategies

To mitigate this vulnerability, update your QNAP operating system to the fixed versions provided by the vendor.

For QTS, upgrade to version 5.2.9.3492 build 20260507 or later.
For QuTS hero, upgrade to version h5.2.9.3499 build 20260514 or later.
For QuTS hero, upgrade to version h5.3.4.3500 build 20260520 or later.
For QuTS hero, upgrade to version h6.0.0.3459 build 20260409 or later.

Additionally, restrict administrator account access to trusted users only, as exploitation requires administrator privileges.

Compliance Impact

This vulnerability allows a remote attacker with an administrator account to exploit a path traversal flaw to read unexpected files or system data. Such unauthorized access to sensitive data could potentially lead to violations of data protection regulations like GDPR or HIPAA, which require strict controls on access to personal and protected health information.

However, the provided information does not explicitly describe the impact on compliance with these standards or any regulatory consequences.

Hi! I’m here to help you understand CVE-2026-24717. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70