CVE-2024-53691High· 8.7▾ MidnightPoC availableA link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locatio…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 47.8 · likelihood 4.8 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
24%
1 GitHub repo (last check)
A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations.
We have already fixed the vulnerability in the following versions: QTS 5.1.8.2823 build 20240712 and later QTS 5.2.0.2802 build 20240620 and later QuTS hero h5.1.8.2823 build 20240712 and later QuTS hero h5.2.0.2802 build 20240620 and later
QTS >= 5.1.x < 5.1.8.2823 build 20240712QTS >= 5.2.x < 5.2.0.2802 build 20240620quts_hero >= h5.1.x < h5.1.8.2823 build 20240712quts_hero >= h5.2.x < h5.2.0.2802 build 20240620We have already fixed the vulnerability in the following versions: QTS 5.1.8.2823 build 20240712 and later QTS 5.2.0.2802 build 20240620 and later QuTS hero h5.1.8.2823 build 20240712 and later QuTS hero h5.2.0.2802 build 20240620 and later
Connected by shared product, vendor, weakness, or advisory.
CVE-2018-19953Medium· 6.1If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code
CVE-2018-19949Critical· 9.8If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands
CVE-2026-41539Medium· 6.3QTS, QuTS hero
CVE-2025-62848High· 7.5A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions
CVE-2025-62849Critical· 9.8An SQL injection vulnerability has been reported to affect several QNAP operating system versions
CVE-2024-38639Medium· 4.8An improper authentication vulnerability has been reported to affect product