CVE-2025-66277
Published: 11 February 2026
Summary
CVE-2025-66277 is a critical-severity Link Following (CWE-59) vulnerability in Qnap Qts. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by identifying, reporting, and correcting the improper link resolution flaw in QNAP OS versions.
Validates file path inputs to prevent improper link resolution before access, blocking traversal to unintended file system locations.
Enforces approved access authorizations for file system resources, limiting unauthorized read, write, or delete operations even if traversal partially succeeds.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated path traversal vuln in public-facing QNAP NAS directly enables T1190 exploitation; resulting arbitrary read/write/delete access maps to T1005 local data access and T1070.004 file deletion.
NVD Description
A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to traverse the file system to unintended locations. We have already fixed the vulnerability in the following versions:…
more
QTS 5.2.8.3350 build 20251216 and later QuTS hero h5.3.2.3354 build 20251225 and later QuTS hero h5.2.8.3350 build 20251216 and later
Deeper analysisAI
CVE-2025-66277 is a link following vulnerability (CWE-59: Improper Link Resolution Before File Access) affecting multiple versions of QNAP operating systems, including QTS and QuTS hero. It enables remote attackers to traverse the file system to unintended locations, potentially exposing sensitive data or enabling unauthorized modifications. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), reflecting its network accessibility, low complexity, lack of prerequisites, and high impact on confidentiality, integrity, and availability. It was published on 2026-02-11.
Remote, unauthenticated attackers can exploit this vulnerability over the network with low effort, as it requires no privileges or user interaction. Successful exploitation allows arbitrary file system traversal, granting read, write, or delete access to files outside intended directories, which could lead to full system compromise, data exfiltration, or persistent access on affected QNAP NAS devices.
QNAP has addressed the issue in patched releases: QTS 5.2.8.3350 build 20251216 and later, QuTS hero h5.3.2.3354 build 20251225 and later, and QuTS hero h5.2.8.3350 build 20251216 and later. Security practitioners should verify systems are updated to these or newer versions and review the official advisory at https://www.qnap.com/en/security-advisory/qsa-26-05 for full details on affected models and upgrade instructions.
Details
- CWE(s)