Cyber Resilience

CVE-2025-59384

High

Published: 02 January 2026

Published
02 January 2026
Modified
22 January 2026
KEV Added
—
Patch
—
CVSS Score v4 8.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0045 35.6th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-59384 is a high-severity Path Traversal (CWE-22) vulnerability in Qnap Qfiling. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-59384 is a path traversal vulnerability (CWE-22) affecting Qfiling, a component developed by QNAP. Published on January 2, 2026, the flaw enables remote attackers to exploit improper handling of file paths, allowing them to access and read the contents of unexpected files or system data on vulnerable systems.

The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating it is exploitable over the network with low complexity, requiring no authentication, privileges, or user interaction. Unauthenticated remote attackers can thus achieve high-impact confidentiality breaches by disclosing sensitive files, while integrity and availability remain unaffected.

QNAP's security advisory (QSA-25-54) confirms the issue has been addressed in Qfiling version 3.13.1 and later. Security practitioners should prioritize updating affected Qfiling installations to mitigate the risk of unauthorized file disclosure.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability details

A path traversal vulnerability has been reported to affect Qfiling. The remote attackers can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qfiling 3.13.1…

more

and later

CWE(s)
CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Path traversal in publicly exposed Qfiling service enables unauthenticated remote file read, mapping directly to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-13086Same product class: NAS / storage appliance
CVE-2025-30276Same product class: NAS / storage appliance
CVE-2025-29894Same product class: NAS / storage appliance
CVE-2025-52870Same product class: NAS / storage appliance
CVE-2025-59385Same product class: NAS / storage appliance
CVE-2025-62849Same product class: NAS / storage appliance
CVE-2026-22898Same product class: NAS / storage appliance
CVE-2025-47206Same product class: NAS / storage appliance
CVE-2025-52425Same product class: NAS / storage appliance
CVE-2025-59389Same product class: NAS / storage appliance

Affected Assets

qnap
qfiling
3.13.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates CVE-2025-59384 by requiring timely installation of the vendor patch in Qfiling 3.13.1 and later to fix the path traversal flaw.

SI-10 Information Input Validation good match
prevent

Prevents exploitation of the path traversal vulnerability by validating file path inputs to block traversal sequences like '../' outside intended directories.

AU-13 Monitoring for Information Disclosure partial match
detect

Detects unauthorized disclosure of sensitive files or system data resulting from successful path traversal attacks on Qfiling.

References