CVE-2024-53691

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations.

We have already fixed the vulnerability in the following versions: QTS 5.1.8.2823 build 20240712 and later QTS 5.2.0.2802 build 20240620 and later QuTS hero h5.1.8.2823 build 20240712 and later QuTS hero h5.2.0.2802 build 20240620 and later

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

No affected versions have been published.

Timeline

Published
Dec 6, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-536924.7A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could CVE-2024-536937.1An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versCVE-2024-536948.6A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect several product versions. If exploited, the vuCVE-2024-536959.1A buffer overflow vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attCVE-2024-536964.9A server-side request forgery (SSRF) vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow remCVE-2024-536977.2An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability couCVE-2024-536984.9A double free vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow CVE-2024-536997.2An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability couCVE-2024-53706.1A vulnerability was found in Kashipara College Management System 1.0. It has been rated as problematic. Affected by this issue is some unknoCVE-2024-537007.2A command injection vulnerability has been reported to affect QHora. If exploited, the vulnerability could allow remote attackers who have gCVE-2024-537013.1Multiple FCNT Android devices provide the original security features such as "privacy mode" where arbitrary applications can be set not to bCVE-2024-537025.3Use of cryptographically weak pseudo-random number generator (PRNG) vulnerability in the SonicWall SMA100 SSLVPN backup code generator that,
CVE-2024-53691: High severity, CVSS 8.8 | Vulnix