CVE-2025-66277

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to traverse the file system to unintended locations.

We have already fixed the vulnerability in the following versions: QTS 5.2.8.3350 build 20251216 and later QuTS hero h5.3.2.3354 build 20251225 and later QuTS hero h5.2.8.3350 build 20251216 and later

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
QNAP Systems Inc.	QTS	>= 5.2.x, < 5.2.8.3350 build 20251216
QNAP Systems Inc.	QuTS hero	>= h5.3.x, < h5.3.2.3354 build 20251225; >= h5.2.x, < h5.2.8.3350 build 20251216

References

https://www.qnap.com/en/security-advisory/qsa-26-05Vendor Advisory

Timeline

Published: Feb 11, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-662786.5A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit CVE-2025-662797.2A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administ CVE-2025-662807.2An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gai CVE-2025-662817.2A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then e CVE-2025-662844.8Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, an CVE-2025-662864.7An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP re CVE-2025-662878.8A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.CVE-2025-662898.8OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application does not invalidate existing s CVE-2025-662904.3OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application’s recruitment attachment retri CVE-2025-662914.3OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the interview attachment retrieval endpoint in CVE-2025-662928.1DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /CVE-2025-662937.1LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.