All vulnerabilities
CVE-2026-41541

Symlink creation in qsyncsrv.cgi

QNAP Systems Inc. Qsync Central
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.54%Chance of exploitation activity in the next 30 days, higher than 44% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.0.0.7Also 5.1.0.3, 5.2.0.5 and 1 moreCVE List
Published15 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.

We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later

Text from CVE List

Affected versions 4

  • Qsync Centralaffected: 5.0.x before 5.0.0.7CVE List
  • Qsync Centralaffected: 5.1.x before 5.1.0.3CVE List
  • Qsync Centralaffected: 5.2.x before 5.2.0.5CVE List
  • Qsync Centralaffected: 5.3.x before 5.3.0.2CVE List

References 1