CVE-2019-7183

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, QNAP recommend updating QTS to their latest versions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

VendorProductVersions
n/aQNAP NAS devicesQTS 4.4.1: before build 20191109, QTS 4.3.6: before build 20190919, QTS 4.3.4: before build 20190921, QTS 4.3.3: before build 20190921, QTS 4.2.6: before build 20191107

References

Timeline

Published
Dec 5, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-71844.8This cross-site scripting (XSS) vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrator’s CVE-2019-71854.8This cross-site scripting (XSS) vulnerability in Music Station allows remote attackers to inject and execute scripts on the administrator’s CVE-2019-71929.8This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, CVE-2019-71939.8This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP CVE-2019-71949.8This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability,CVE-2019-71959.8This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability,CVE-2019-71974.8A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability mayCVE-2019-71989.8This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed thCVE-2019-72017.8An unquoted service path vulnerability is reported to affect the service QVssService in QNAP NetBak Replicator. This vulnerability could allCVE-2019-72116.1SmarterTools SmarterMail 16.x before build 6995 has stored XSS. JavaScript code could be executed on the application by opening a malicious CVE-2019-72128.2SmarterTools SmarterMail 16.x before build 6985 has hardcoded secret keys. An unauthenticated attacker could access other users’ emails and CVE-2019-72136.5SmarterTools SmarterMail 16.x before build 6985 allows directory traversal. An authenticated user could delete arbitrary files or could crea