CVE-2026-24718: QNAP Systems Inc Qsync Central

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later

Affected products

• QNAP Systems Inc Qsync Central: from 5.0, before 5.0.0.7 (fixed in 5.0.0.7); from 5.1, before 5.1.0.3 (fixed in 5.1.0.3); from 5.2, before 5.2.0.5 (fixed in 5.2.0.5); from 5.3, before 5.3.0.2 (fixed in 5.3.0.2)

Published 2026-10-15. Last modified 2026-10-15.