CVE-2025-33032

MediumCVSS 4.9/10Last modified Sep 26, 2026

Description

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
QNAP Systems Inc.QTS>= 5.2.x, < 5.2.5.3145 build 20250526
QNAP Systems Inc.QuTS hero>= h5.2.x, < QuTS hero h5.2.5.3138 build 20250519

References

Timeline

Published
Aug 29, 2025
Last modified
Sep 26, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-330336.5A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit tCVE-2025-330346.5A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit tCVE-2025-330356.5A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploitCVE-2025-330366.5A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit tCVE-2025-330376.5A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit tCVE-2025-330386.5A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit tCVE-2025-330396.5An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains CVE-2025-33048.8A vulnerability, which was classified as critical, was found in code-projects Patient Record Management System 1.0. This affects an unknown CVE-2025-330406.5An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains CVE-2025-330427.3Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusCVE-2025-330436.1APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation locally. Successful exploitation of this vuCVE-2025-330447.8APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buff
CVE-2025-33032: Medium severity, CVSS 4.9 | Vulnix