CVE-2026-24717

MediumCVSS 6.5/10Last modified Jul 23, 2026

Description

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3459 build 20260409 and later

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Jun 10, 2026
Last modified: Jul 23, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-247185.3A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit t CVE-2026-247197.2A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administ CVE-2026-24728.1Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versi CVE-2026-247206.5An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 6. If a remote attacker gains CVE-2026-247216.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can the CVE-2026-247226.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can the CVE-2026-247236.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can the CVE-2026-247248.1An incorrect authorization vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can the CVE-2026-247279.3An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Managemen CVE-2026-247289.3A missing authentication for critical function vulnerability in the /servlet/baServer3 endpoint of Interinfo DreamMaker versions before 2025 CVE-2026-2472910.0An unrestricted upload of file with dangerous type vulnerability in the file upload function of Interinfo DreamMaker versions before 2025/10 CVE-2026-24737.7Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not including) 1.133.0 on Google