CVE-2026-41541
MediumCVSS 5.3Summary
An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. The vulnerability has been fixed in versions 5.0.0.7, 5.1.0.3, 5.2.0.5, and 5.3.0.2 and later.
Risk Assessment
Exploitation may allow an attacker to access files or resources outside the intended scope, potentially leading to a breach of confidentiality or integrity.
Recommendation
Update Qsync Central to version 5.0.0.7, 5.1.0.3, 5.2.0.5, or 5.3.0.2 (or later) and restrict user privileges to the minimum necessary.
Other vulnerabilities in Qsync Central
See all- CVE-2026-26243High
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
- CVE-2026-24718Medium
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
- CVE-2025-29897Low
A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes.
- CVE-2025-29896Low
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
- CVE-2025-29895Low
A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack.
Original NVD description (English source)
An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS