We have already fixed the vulnerability in the following version:
Qsync Central 5.0.0.7 and later
Qsync Central 5.1.0.3 and later
Qsync Central 5.2.0.5 and later
Qsync Central 5.3.0.2 and later
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| QNAP Systems Inc. | Qsync Central | unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 15 Oct 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later | |
| Title | Path Traversal Vulnerability in Qsync Central's qsyncsrv.cgi | |
| Weaknesses | CWE-22 | |
| References |
| |
| Metrics |
cvssV4_0
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: qnap
Published:
Updated: 2026-10-15T14:52:16.569Z
Reserved: 2026-01-26T06:41:35.897Z
Link: CVE-2026-24718
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-15T07:17:59.610
Modified: 2026-10-15T08:16:37.467
Link: CVE-2026-24718
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')