CVE-2025-66277

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-66277 is a link following vulnerability (CWE-59: Improper Link Resolution Before File Access) affecting multiple versions of QNAP operating systems, including QTS and QuTS hero. It enables remote attackers to traverse the file system to unintended locations, potentially exposing sensitive data or enabling unauthorized modifications. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), reflecting its network accessibility, low complexity, lack of prerequisites, and high impact on confidentiality, integrity, and availability. It was published on 2026-02-11.

Remote, unauthenticated attackers can exploit this vulnerability over the network with low effort, as it requires no privileges or user interaction. Successful exploitation allows arbitrary file system traversal, granting read, write, or delete access to files outside intended directories, which could lead to full system compromise, data exfiltration, or persistent access on affected QNAP NAS devices.

QNAP has addressed the issue in patched releases: QTS 5.2.8.3350 build 20251216 and later, QuTS hero h5.3.2.3354 build 20251225 and later, and QuTS hero h5.2.8.3350 build 20251216 and later. Security practitioners should verify systems are updated to these or newer versions and review the official advisory at https://www.qnap.com/en/security-advisory/qsa-26-05 for full details on affected models and upgrade instructions.