CVE-2026-24717
Received Received - Intake
Path Traversal in QNAP QTS and QuTS hero

Publication date: 2026-06-10

Last updated on: 2026-06-10

Assigner: QNAP Systems, Inc.

Description
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3459 build 20260409 and later
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-10
Last Modified
2026-06-10
Generated
2026-06-10
AI Q&A
2026-06-10
EPSS Evaluated
N/A
NVD
CVE-2026-24717
EUVD
EUVD-2026-35976
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
qnap qts From 5.2.9.3492 (inc)
qnap quts_hero From h5.2.9.3499 (inc)
qnap quts_hero From h5.3.4.3500 (inc)
qnap quts_hero From h6.0.0.3459 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue affecting several QNAP operating system versions. It allows a remote attacker who has already obtained an administrator account to exploit the vulnerability and read the contents of files or system data that they should not normally have access to.

Impact Analysis

If exploited, this vulnerability can allow an attacker with administrator privileges to access sensitive or unexpected files and system data. This could lead to unauthorized disclosure of confidential information, potential data breaches, and compromise of system integrity.

Mitigation Strategies

To mitigate this vulnerability, update your QNAP operating system to the fixed versions provided by the vendor.

  • For QTS, upgrade to version 5.2.9.3492 build 20260507 or later.
  • For QuTS hero, upgrade to version h5.2.9.3499 build 20260514 or later.
  • For QuTS hero, upgrade to version h5.3.4.3500 build 20260520 or later.
  • For QuTS hero, upgrade to version h6.0.0.3459 build 20260409 or later.

Additionally, restrict administrator account access to trusted users only, as exploitation requires administrator privileges.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24717. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart