CVE-2025-66277 — CRITICAL (9.8)

Vulnerability Description

A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to traverse the file system to unintended locations. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3350 build 20251216 and later QuTS hero h5.3.2.3354 build 20251225 and later QuTS hero h5.2.8.3350 build 20251216 and later

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Qnap	Qts	5.2.0.2737
Qnap	Quts Hero	h5.2.0.2737

Related Weaknesses (CWE)

CWE-59

References

https://www.qnap.com/en/security-advisory/qsa-26-05Vendor Advisory

FAQ

What is CVE-2025-66277?

CVE-2025-66277 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to traverse the file system to unintended loc...

How severe is CVE-2025-66277?

CVE-2025-66277 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2025-66277?

Check the references section above for vendor advisories and patch information. Affected products include: Qnap Qts, Qnap Quts Hero.