CVE-2025-30270
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
Risk Assessment
An attacker with regular user privileges can access files and system data they should not have access to. This may lead to information disclosure and breach of data confidentiality.
Recommendation
Update QTS to version 5.2.5.3145 build 20250526 or later, and QuTS hero to version h5.2.5.3138 build 20250519 or later. It is also recommended to review user account permissions.
Other vulnerabilities in QNAP QTS/QuTS hero
See all- CVE-2020-2509CriticalActively exploited
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application.
- CVE-2025-33032Medium
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
- CVE-2025-30273High
An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory.
- CVE-2025-30271Medium
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
- CVE-2025-30264High
A command injection vulnerability has been reported to affect several QNAP operating system versions. A remote attacker who gains a user account can exploit the vulnerability to execute arbitrary commands.
Original NVD description (English source)
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS