CVE-2025-59380

MediumCVSS 4.9/10Last modified Oct 14, 2026

Description

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following versions: QTS 5.2.8.3332 build 20251128 and later QuTS hero h5.2.8.3321 build 20251117 and later

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jan 2, 2026
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-593814.9A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administratCVE-2025-593821.2QTS, QuTS hero, QuTScloud are not affected. We have already fixed the vulnerability in the following version:CVE-2025-593839.1A buffer overflow vulnerability has been reported to affect Media Streaming Add-On. The remote attackers can then exploit the vulnerability CVE-2025-593847.5A path traversal vulnerability has been reported to affect Qfiling. The remote attackers can then exploit the vulnerability to read the contCVE-2025-593859.8An authentication bypass by spoofing vulnerability has been reported to affect several QNAP operating system versions. The remote attackers CVE-2025-593864.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an aCVE-2025-593878.1An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). The remote attackers can then exploit CVE-2025-593889.8A use of hard-coded password vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulneCVE-2025-593899.8An SQL injection vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to CVE-2025-59394.4The Telegram for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and includinCVE-2025-593909.8Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuCVE-2025-593916.5A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds
CVE-2025-59380: Medium severity, CVSS 4.9 | Vulnix