CVE-2026-26243: QNAP Systems Inc Qsync Central

High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days.

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.6 and later Qsync Central 5.1.0.2 and later Qsync Central 5.2.0.4 and later

Affected products

• QNAP Systems Inc Qsync Central: from 5.0, before 5.0.0.6 (fixed in 5.0.0.6); from 5.1, before 5.1.0.2 (fixed in 5.1.0.2); from 5.2, before 5.2.0.4 (fixed in 5.2.0.4)

Published 2026-10-15. Last modified 2026-10-15.