CVE-2025-59381

MediumCVSS 4.9/10Last modified Oct 14, 2026

Description

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following versions: QTS 5.2.8.3332 build 20251128 and later QuTS hero h5.2.8.3321 build 20251117 and later QuTS hero h5.3.2.3354 build 20251225 and later

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Jan 2, 2026
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-593821.2QTS, QuTS hero, QuTScloud are not affected. We have already fixed the vulnerability in the following version:CVE-2025-593839.1A buffer overflow vulnerability has been reported to affect Media Streaming Add-On. The remote attackers can then exploit the vulnerability CVE-2025-593847.5A path traversal vulnerability has been reported to affect Qfiling. The remote attackers can then exploit the vulnerability to read the cont CVE-2025-593859.8An authentication bypass by spoofing vulnerability has been reported to affect several QNAP operating system versions. The remote attackers CVE-2025-593864.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an a CVE-2025-593878.1An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). The remote attackers can then exploit CVE-2025-593889.8A use of hard-coded password vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulne CVE-2025-593899.8An SQL injection vulnerability has been reported to affect Hyper Data Protector. The remote attackers can then exploit the vulnerability to CVE-2025-59394.4The Telegram for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and includin CVE-2025-593909.8Apache Druid’s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configu CVE-2025-593916.5A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds CVE-2025-593926.8On Elspec G5 devices through 1.2.2.19, a person with physical access to the device can reset the Admin password by inserting a USB drive (co